Security and Governance
This page lists the controls that actually exist and states plainly what GearDock does not have. Both halves matter. A vendor that only lists its strengths has told you very little.
Start Here
Every one of these appears on a great many software websites. None of them is true of GearDock today, so none of them appears anywhere else on this site.
GearDock is not a HIPAA-compliant system and must not be used with protected health information.
No SOC 2 audit has been completed, and no report exists.
GearDock is catalog software. It is not a medical device and holds no regulatory clearance.
A manufacturer document can be wrong, and reading a dense table can go wrong. Being able to trace a claim lets you find and fix those errors. It does not prevent them.
No software removes the risk of publishing something incorrect. GearDock lowers it and makes it correctable.
Human review and a separate release decision are required. That is a deliberate design choice, not a gap we intend to close later.
No Patient Information
The Controls
Described in enough detail to evaluate, and no more. Implementation specifics are left out because they would be more useful to an attacker than to you.
Every product, document, draft, decision, and audit record belongs to exactly one organization.
Members hold roles that decide what they can do, and the powerful actions are kept apart on purpose.
Content only leaves GearDock after a person has approved it and a separate decision has released it.
What a statement was based on, and what the content said at a given moment, both stay available.
Governed actions are written down as events, and events are only ever added.
Content leaves through a single gate, and that gate does not take the earlier checks on trust.
Where the Controls Sit
The controls run underneath the four actions catalog staff actually perform. That is deliberate. A governance system that everyone has to understand is a governance system people work around.
What your team does
runs on
What the platform maintains
How It Is Built
Stated at the level that belongs on a public page. Ask us for more and we will answer directly.
Questions
No. GearDock is a product catalog system, not a system for patient data. Protected health information must not be uploaded, and we make no HIPAA claim.
No. No SOC 2 audit has been completed. We would rather say that plainly than imply a certification we do not hold.
No. Every record belongs to exactly one organization, the boundary is enforced on the server and in the database, and content cannot reference another organization's evidence.
No. Audit history is added to and never changed. Entries cannot be edited or removed by any role, and a correction is recorded as a new event alongside the original.
You can find every product that cited it. The correction is then applied across that known set as one recorded change, with its own review and its own audit entry, rather than by searching the catalog by hand.
Data is held in managed cloud infrastructure, scoped to your organization, and reachable only through authorized requests that are checked on the server. If you need specifics for a vendor review, ask and we will answer directly rather than through a marketing page.
Yes, for whatever we can answer honestly. Where the answer is no, or not yet, we will say so rather than giving you a qualified yes.
Private Beta
We will answer what we can answer honestly and tell you plainly where the answer is no, or not yet. That is a more useful basis for a decision than a confident document.