ULTIM LEADS · VERSION 2026-10-19.2
Security & HIPAA
Our responsibilities, shared safeguards and the limits of current compliance claims.
Effective October 19, 2026 · Contact ULTIM
“ULTIM”, “we” and “us” mean the operator identified in the company identification. These documents apply together where expressly incorporated.
1. Shared responsibility
ULTIM operates the service; customers manage users, business instructions, lawful collection and suitability. Providers operate infrastructure and connected services under their agreements. Public HTTPS, authentication, tenant controls and private storage are architectural measures, not absolute guarantees or certification. Particular security, audit, retention or availability commitments require a documented order.
2. Support and incidents
Promptly report suspected compromise or unauthorized access to the contact below with minimum details identifying the account, without secrets or sensitive attachments. Support access is limited to authorized operational, recovery, security or legal needs. Data processing agreement addresses personal-data incidents. No absolute protection from outages, intrusion, loss or disclosure is promised.
3. Current HIPAA position
ULTIM Leads does not currently represent that every workspace or the platform as a whole is HIPAA compliant or HIPAA certified. A provider offering HIPAA support does not establish that our account, contract, configuration, feature and downstream providers meet the requirements. Applicability depends on the parties and use, not solely on a record mentioning health. Do not submit HIPAA-regulated protected health information until necessary BAAs are executed and ULTIM expressly confirms the eligible scope and configuration in writing. Accepting these policies is not that confirmation.
4. Provider and channel eligibility
Supabase requires applicable BAA and HIPAA configuration; ElevenLabs has BAA and retention requirements; OpenAI API requires BAA and eligible configurations and services; Railway eligibility depends on contract and deployment. Twilio coverage is product-specific. Do not assume WhatsApp, email, every AI endpoint or integration is covered because a voice or SMS product may be eligible. Resend’s public security information and enterprise terms require account-specific clarification before any PHI use. This page does not assert that current provider BAAs have been executed.
5. Before a regulated deployment
Determine legal roles and risks; execute customer and downstream agreements; validate data flows, products, regions and retention; establish access, incident, training, backup and deletion procedures; and verify safeguards operationally. A disclaimer or BAA alone is not full compliance. Arrange separate review before activating a regulated deployment.
6. Accessibility and assistance
We aim for keyboard navigation, readable layouts and assistive-technology support. Report barriers with the page and issue so we can investigate and offer reasonable assistance. This is not a claim of completed independent accessibility certification.
7. Customer security responsibilities
Use unique credentials, appropriate account protection and the least access each team member needs. Review connected provider permissions and promptly remove departed users. Do not place secrets in agent prompts, document names, ordinary chat messages or support requests. Keep devices and browsers appropriately secured. Report suspected unauthorized use promptly so the affected sessions, integrations and records can be assessed. These shared responsibilities do not release ULTIM from safeguards or incident duties that apply to its own processing.
8. Safeguards versus contractual guarantees
Authentication, role restrictions, tenant segregation, private attachments and protected transport are elements of the service design. Their presence is not proof that every implementation path is defect-free or that an independent assessment has certified the platform. Particular commitments about encryption, privileged access, log retention, availability, backup restoration or audit reporting must be supported by the actual configuration and any controlling Order. A public statement about a provider’s certification is not a certification of ULTIM’s whole product. We do not publish confidential security details that would expose customers or enable abuse.
9. Recovery, backups and export
Backups and workflow persistence can support recovery, but a visible historical record does not establish that every file, provider event or external message can be restored. Recovery depends on the affected system, available copies, retention, authorization and the nature of the failure. A specific recovery point, recovery time or successful restore test must be documented if required for the Customer’s use. Customers should maintain lawful exports and independent continuity procedures appropriate to their business, without creating insecure duplicate stores of sensitive information.
10. Healthcare scope and contractual prerequisites
If a proposed use makes a party a covered entity or business associate under HIPAA, the parties must identify the relevant data flows, enter the necessary BAAs and verify the eligible downstream services before that processing begins. A product badge, general DPA, template approval or ordinary service subscription is not a substitute. The permitted scope must account for telephone audio, transcripts, message content, documents, backups, logging, AI requests and support access. Processing outside the approved scope is not authorized merely because another feature has been reviewed. Historical sensitive-data use may require its own assessment; a later contract does not retroactively establish prior compliance.
11. Vulnerability reports and coordinated investigation
Report a suspected vulnerability to support@ultimmarketing.com with the minimum safe information needed to reproduce it. Do not access another customer’s information, disrupt the service, extract records or publish secrets to demonstrate an issue. The parties may coordinate a safe test where appropriate; sending a report does not itself authorize intrusive testing or create a promise of payment. Security communications should distinguish a suspected weakness, confirmed exposure and completed remediation. ULTIM will assess reports and applicable notification duties without representing that every allegation is a confirmed breach.
Contact ULTIM
For privacy, support, cancellation or billing questions, identify your account and request. Do not send passwords, payment credentials or sensitive client files in an initial email. Company identification & postal correspondence.
Version 2026-10-19.2 · Print or save a copy for your records. Previous versions are available on request.