Security & Trust

We Sign a BAA. Before We Touch Anything.

If you're a covered entity under HIPAA -- a medical practice, behavioral health provider, or healthcare-adjacent business -- IT CloudLink LLC signs a Business Associate Agreement before any engagement begins. This is a legal requirement, and it's non-negotiable. If a vendor won't sign a BAA, walk away.

Where Your Data Runs

IT CloudLink LLC's private AI and managed IT services run on hardware you own, on your premises. IT CloudLink LLC hosts no client models and operates no remote inference service.

By default, requests run locally and nothing leaves your network. A request goes to an outside model provider only for a workload you have enabled in writing. Regulated data -- protected health information, privileged material, anything covered by a BAA -- stays on local inference unless you authorize an exception under a BAA with that provider.

When a request does leave, it goes from your gateway straight to the provider on your own account. It does not pass through IT CloudLink LLC or Rondthaler.dev infrastructure. Every routed request is logged at the gateway, and the log is yours.

The full rules, including the conditions for an exception, are in the Data Routing Policy.

Compliance Is Built In, Not Bolted On

IT CloudLink LLC has been working with healthcare, legal, and other professional service clients -- including entertainment and automotive -- for years. Our security practices are designed around the three safeguard categories the HIPAA Security Rule (45 CFR §164) defines, and are informed by NIST cybersecurity frameworks and applicable industry standards:

Administrative safeguards · Technical safeguards · Physical safeguards

Network Security Is Our Day Job

IT CloudLink LLC operates enterprise-grade network infrastructure: VLAN segmentation, Layer 3 firewall policy enforcement, encrypted remote access, and continuous network monitoring. Remote access to client systems is always authenticated, always encrypted, and always logged. We don't use consumer-grade remote tools for client work.

Private AI That Regulated Industries Can Actually Use

The free and consumer tiers of ChatGPT, Gemini and Copilot are not BAA-eligible, and should not touch protected health information, privileged legal matter, or sensitive business data. Some enterprise and API tiers do offer a Business Associate Agreement, and those are the only tiers eligible for a routed workload. Confirm a vendor's current terms before relying on them. And a BAA is a contractual protection for data that still leaves your building and is processed in someone else's cloud.

IT CloudLink LLC is building and validating private, local LLM infrastructure -- designed and validated through Rondthaler.dev, see the live R&D Log for exactly where it stands --: inference runs on your hardware, your content is not used to train models, local workloads carry no cloud dependency, and system access is logged. Where a workload is routed to an outside provider, that provider's own terms govern training and retention.