Blog

EU AI Act Timeline: Every Deadline From 2025 to 2030, and What to Do Before Each

The EU AI Act timeline as of October 2026: what already applies, the new 2027 and 2028 high-risk deadlines, and a dated action plan for SaaS and HealthTech.

HIPAA Data Retention Requirements: What to Keep, How Long, and How to Dispose of It

HIPAA data retention requirements explained: which documents the six-year rule covers, why medical records follow state law, and how to dispose of PHI safely.

MAS TRM Guidelines: What SaaS and HealthTech Vendors Selling to Singapore Financial Institutions Need to Know

MAS TRM guidelines explained for SaaS and HealthTech vendors: what they cover, how they differ from binding MAS notices, and how to pass bank security reviews.

Risk and Control Self-Assessment (RCSA): Process, Template and Examples

Risk and control self-assessment (RCSA) explained: run owner-led workshops, rate inherent and residual risk, and feed results into SOC 2 and ISO 27001.

AI Clauses in Customer Contracts: What to Commit to and How to Prove It

AI clauses in customer contracts explained for SaaS and HealthTech vendors: what buyers ask for, which terms to accept, and how to back each one with evidence.

Essential Eight for Government Suppliers: What Australian Agencies Expect From SaaS Vendors

Essential Eight for government suppliers explained: how PSPF duties reach SaaS vendors through contracts, plus IRAP, HCF and a plan to win tenders.

HIPAA Compliant File Sharing: A Checklist for Sharing PHI Securely

HIPAA compliant file sharing checklist: when a service needs a BAA, which technical safeguards apply, and how to configure links, access and logs for PHI.

HIPAA De-identification: Safe Harbor, Expert Determination and Limited Data Sets

HIPAA de-identification explained for HealthTech teams: Safe Harbor, Expert Determination and limited data sets, to safely use patient data for analytics or AI.

ISO 27799: Health Information Security Controls and How They Fit ISO 27001

ISO 27799 explained: what the 2025 health informatics edition covers, how it differs from ISO 27001, and how SaaS teams apply it alongside HIPAA.

PHI in Logs: How to Keep Health Data Out of Your Application and Observability Logs

Keep PHI in logs under control: where sensitive data leaks into app, error and LLM logs, how to redact it, and which audit logs HIPAA still expects you to keep.