Certifications and compliance status
None yet — SOC 2 is in preparation and that is the whole of the status; nobody has audited Qlynic against anything, ISO 27001, HITRUST and PIPEDA certification are not held or claimed, and what can be checked instead are the facts: Azure Canada Central hosting, Arxeon's H-Link accreditation, the Alberta corporate registry number, and a once-a-year security summary and questionnaire under the Information Manager Agreement.
2705
The status, plainly
SOC 2 is in preparation. Nobody has audited Qlynic against anything yet. ISO 27001, HITRUST and any PIPEDA certification are not held and are not claimed anywhere on the site. HIPAA is a US law; Qlynic is built around Alberta's Health Information Act and Canada's PIPEDA, and the telehealth page notes that readiness for other provincial acts (PHIPA, FIPPA) is available on request.
What is checkable instead
- The system of record is hosted in Microsoft Azure's Canada Central region, with Microsoft's own certified data centres and the encryption that platform applies at rest and in transit.
- Arxeon is an accredited H-Link submitter — a status granted by Alberta Health after conformance testing.
- Arxeon Inc. is an Alberta corporation, registry number 2028072771, on the public record.
- The security page lists every enforced constant (lockouts, thresholds, cookie intervals) and what is not claimed, including that two-factor sign-in is not yet available.
For your own review
Under the Information Manager Agreement a clinic may request, once a year absent an incident, a summary of Arxeon's security and privacy controls, relevant third-party attestations for the hosting provider, and answers to a reasonable security questionnaire — enough for HIA oversight and a PIA. Nothing that would compromise the security of the platform or other clinics is disclosed.
Where to look