Which Unified APIs Are SOC2 and HIPAA Compliant?
·
If you're building a SaaS or AI-native product that integrates with sensitive customer data, compliance matters. Whether you're handling employee records, syncing CRM data, or connecting file storage platforms, you're expected to meet the security and privacy standards required by your customers and regulators.
This post clarifies which Unified APIs can be used in HIPAA-regulated environments, what our SOC 2 Type II and HIPAA compliance really means, how we compare to competitors like Merge.dev, Truto, Apideck, and Paragon, and how our architecture helps reduce your risk.
Unified.to's Platform Compliance
Unified.to is SOC 2 Type II attested and compliant with HIPAA, GDPR, PIPEDA, and CCPA. These apply at the platform level, not just to individual endpoints. That means every API category built on Unified.to inherits the same security posture:
- SOC 2 Type II: Attested to the AICPA Trust Services Criteria for security, availability, and confidentiality
- HIPAA-aligned: On the Scale plan, Unified will sign Business Associate Agreements (BAAs) for covered entities or business associates handling PHI
- PIPEDA (Canada): Personal data handled in accordance with Canadian privacy law
Real-Time, Stateless Architecture
Unified.to is not a database. It's a real-time API platform built on a zero-storage, stateless passthrough model:
- We never store your customers' data at rest
- Every API request fetches data live from the source system
- No caching, no snapshots, no stale records
- Logs hold only operational metadata (endpoint, timing, status, workspace), never payloads
- Connection credentials are stored encrypted at rest, per the privacy policy
This architecture eliminates PII and PHI persistence risk. Unified.to is a subprocessor: the data flows through our platform but never resides on our infrastructure.
What Unified APIs Handle (and Don't Handle)
Unified.to provides normalized access to 1627 integrations across 36 API categories, including:
- CRM (including Salesforce, HubSpot and Pipedrive)
- HRIS & ATS (including BambooHR, Greenhouse and Personio)
- File Storage (including Google Drive, Dropbox and Box)
- Calendar & Scheduling (including Google, Microsoft and Calendly)
- Ticketing & Support (including Zendesk and Intercom)
Unified.to does not store records or operate as a system of record. Your application controls where data is retained, stored, or processed. That distinction matters, especially for HIPAA, GDPR, and PIPEDA audits.
How Do Unified APIs Compare on SOC 2 and HIPAA?
As of 8 October 2026, Unified.to, Merge.dev, Truto and Paragon all publish SOC 2 Type II and a HIPAA claim. They differ on who can sign a BAA and on whether the platform keeps a copy of your customers' data. Apideck publishes SOC 2 Type II but no HIPAA attestation or BAA.
| Platform | SOC 2 Type II | HIPAA Compliant | BAA Offered | Data Stored |
|---|---|---|---|---|
| Unified.to | Yes | Yes | Yes (Scale plan) | No, passthrough only; logs hold metadata, never payloads |
| Merge.dev | Yes | Yes | Yes, click-through, no plan restriction | Yes, until deleted (Passthrough on Professional and Enterprise) |
| Truto | Yes | Listed as active on its trust centre, worded "in alignment with" HIPAA | Mentioned in blog posts only; not on pricing, trust centre or DPA | Not by default; opt-in SuperQuery is a Truto-managed store; whether logs hold payloads is not published |
| Apideck | Yes | Not listed | Not published | No business records. Logs: Apideck's own pages disagree. Its API logs page says "full request and response bodies" are captured by default, while its zero-data-retention page describes optional request metadata |
| Paragon | Yes | Claimed on its security page and trust centre (2026 certificate, request access); its January 2026 changelog scopes it to self-hosted installations | Enterprise, per a Paragon blog only | Yes on cloud (an encrypted replica of synced data); stays in your infrastructure when self-hosted |
| Which platform fits depends on whether your priority is BAA availability, data at rest or deployment model: |
- Choose Unified.to when PHI must not be stored by the integration layer. Unified.to keeps no copy of customer data, and its logs hold no payloads. The trade-off: the BAA is available only on the Scale plan.
- Choose Merge.dev when you need a BAA on any plan. Merge publishes a click-through BAA with no plan restriction and also lists ISO 27001. The trade-off: Merge stores synced end-user data until you delete it, so PHI sits in a second system your audit has to cover.
- Choose Paragon when you must self-host with a documented HIPAA deployment. Self-hosting is Enterprise only, and it is the deployment Paragon's changelog names for HIPAA. Unified.to's Enterprise plan also offers on-prem or single-tenant hosting. Confirm the BAA in your contract, because Paragon mentions one only in a blog. On Paragon's cloud, synced data is stored as an encrypted replica.
- Choose Truto when you want pass-through by default and an ISO 27001 certificate. Truto keeps no copy of your customers' data by default and holds SOC 2 Type II and ISO 27001. The trade-offs: its opt-in SuperQuery is a Truto-managed store, it does not publish whether its logs hold payloads, and it mentions BAAs only in blog posts (one says it signs them "for customers on plans that include HIPAA scope"), not on its pricing, trust centre or DPA. Confirm the BAA and the plan in your contract (as of 8 October 2026).
- Apideck is not a fit for PHI until it publishes a HIPAA attestation or BAA.
Categories Common in Regulated Workflows
These Unified API categories are often used in HIPAA- or PII-adjacent workflows:
- HR & Directory: employee benefits, FMLA, health coverage
- CRM: contact records and outreach data containing PII
- Messaging: support cases or appointment reminders
- File Storage: uploaded health documents, consent forms
Because Unified.to never stores this data, our role in the compliance chain is that of a subprocessor handling real-time transfer, not storage.
Clarifying the Myth: "HIPAA-Compliant Integrations"
Compliance applies to the platform and architecture, not to the third-party apps themselves. Unified.to does not certify that Salesforce, Notion, or any connected system is HIPAA compliant.
Instead:
- Unified.to enables HIPAA-aligned data transfer
- Customers must still ensure that connected third-party apps meet compliance requirements
- A BAA with Unified applies only to our infrastructure and handling
Credentials, Residency & Audit Controls
Unified customers retain full control over authorization:
- Use your own OAuth client credentials for branded auth
- Store API tokens in your own secrets manager, including AWS Secrets Manager, Azure Key Vault, Google Cloud Secrets Manager, HashiCorp Vault, 1Password, Doppler and Bitwarden (BYOK, Pro and Scale plans)
- Restrict access by IP, enforce SAML SSO, and ship logs to Datadog, Grafana or ClickHouse (Pro and Scale plans)
- Choose your data residency: each workspace runs in one region (US, Europe or Australia)
Final FAQ: So, Which Unified APIs Are HIPAA Compliant?
All Unified APIs share the same compliance profile. If Unified.to is deployed in a HIPAA-regulated product:
- You can use any integration category that involves PHI (e.g., HRIS, calendar, messaging) under a BAA (Scale plan)
- No customer data is ever stored on Unified.to's servers
- Your compliance scope is smaller with a passthrough design
For SOC 2, HIPAA, GDPR, or PIPEDA compliance documentation, visit the Trust Center.
→ Start your 30-day free trial
Disclaimer: Unified.to's SOC 2 Type II and HIPAA compliance applies to our platform only. Customers are responsible for ensuring connected third-party applications and data usage meet their own regulatory requirements.
Written by Mallory Greene.
About the author: Mallory Greene is Head of Marketing at Unified.to. She writes about integration infrastructure, unified APIs, and MCP for technical teams. Based in Toronto.