Legal
Service levels
What we do to keep IMECore available and correct, how we handle incidents, and how your workspace can verify that. We describe what is true of the service today.
Last updated: 28 August 2026. The signed order form or service agreement governs. If there is a conflict, the signed document governs.
We do not publish an uptime percentage. We have not measured for long enough to stand behind a number. The commitments below are qualitative and verifiable.
What we run
The platform today
IMECore runs on Cloudflare Workers with D1, R2, KV, and Queues. The application is deployed as a Worker through OpenNext.
- Workers serve the application and the API. Scaling and availability come from the platform.
- D1 stores case, claimant, record index, and audit rows. R2 stores PDFs and rendered reports.
- Queues handle the outbox for mail and other async work. No case leaves the system without a human approval.
We do not claim an availability percentage because we cannot verify one from production history. Your signed agreement sets any numeric target and any credit where one applies.
Commitments
What we commit to do
Respond
We respond to a service disruption or a report of a privacy risk within one business day. For a suspected breach, we start containment immediately per the report and breach steps.
Keep the audit trail
Every access to health information is logged. The log is append-only. You can request an export for a claim file or a grievance response.
Respect the workspace boundary
One workspace cannot read another's cases. Role-based permissions control what each person can do inside the workspace.
Respect the residency rule
Health information inference runs only in Canada and is verified per call. Storage uses the Western North America location hint, best-effort. There is no Canada jurisdiction on D1 or R2 today. We do not reduce that protection without your agreement.
Protect transmission
Mailbox tokens are encrypted with AES-256-GCM. Outbound mail and browser traffic use TLS. No portal link carries a second copy of the file by email.
Honor retention and deletion
Retention policies are set per data class and client type. Elapsed cases wait for a person to approve deletion. Deletion removes the files and the derived indexes. Legal hold blocks deletion.
When something goes wrong
Incidents and maintenance
- We tell you. For a service disruption that affects your workspace we post a notice to the workspace contacts and in the product. For a breach that meets the risk bar we follow the breach-notification steps in the DPA and the law.
- Planned work runs outside your peak hours where possible. We post notice in advance when work may affect availability.
- Your signed agreement sets the support channel, response window, and any credit or remedy for a missed service level. This page does not set them.
There is no status page today. When we publish one we will link it here. Until then the workspace admin contact is the channel.
Verify
How you can verify the service
- Ask your workspace admin to export the audit log for a case. The export proves who accessed what and when.
- Ask for the deployment findings for your environment. We share the storage residency gaps openly.
- Review the subprocessor list for who may touch your data and where. The signed DPA carries the residency commitments.
We provide our security and privacy documentation on request: the Privacy Impact Assessment, records of processing, data processing agreement, subprocessor list, and breach-response runbook.
FAQ
Questions about service levels
Do you offer 99.9% uptime?
We do not publish a percentage we cannot verify from production history. We describe what we monitor, how we respond, and what your signed agreement says about remedies. If we can evidence a number in the future, we will publish it.
What is the remedy if you miss the service level?
Remedies live in your signed order form or service agreement. This page describes the commitment. The signed document sets credits or other remedies where they apply.
Need a service level in your agreement?
We set numbers where we can measure and meet them. Tell us the commitment you need and we will put it in the order form.