Application architecture
The Windows application communicates with a local backend. The local backend routes AI-related requests through the Azure Gateway, which uses authenticated API endpoints.
← Return to ReportRocketYour Reports Move Fast.
GLAZCO TECHNOLOGIES LLC / SECURITY & TRUST CENTER
Your Reports Move Fast.
Patient Data Stays Protected.
ReportRocket is developed and operated by Glazco Technologies LLC. Protecting sensitive healthcare information is fundamental to how our company designs and operates ReportRocket. Explore our approach to security, privacy, infrastructure, and responsible data handling.
01 / OUR APPROACH
Security starts with how we build.
ReportRocket combines a Windows reporting application with supporting services. We prioritize thoughtful handling of sensitive information and distinguish safeguards implemented in development from protections that still require production validation.
Identity & access
The Gateway validates bearer tokens using Microsoft Entra External ID settings. The desktop app supplies access tokens to the local backend through an authentication broker.
Responsible data handling
Gateway-mediated AI requests reduce direct exposure of provider credentials on the workstation. Workstation storage, logging, and retention practices are evaluated as part of ongoing security management.
Continuous improvement
Security controls, testing, infrastructure configuration, and operating procedures continue to be evaluated as ReportRocket develops.
Found a potential vulnerability? Read our responsible security reporting guidance.
02 / TECHNOLOGY FOUNDATION
Built with Microsoft Azure technologies.
ReportRocket uses Microsoft Azure for its website and AI Gateway. The website and AI Gateway run on Azure. Specific networking, monitoring, and data-handling configurations are assessed as part of ongoing security governance.
Azure App Service
Hosts the ReportRocket website and AI Gateway.
Microsoft Entra External ID
Supports desktop sign-in and authentication of requests to the Gateway.
Azure Key Vault
Provides secrets-management capabilities within the Azure environment. Details of access policies and credential rotation are available for appropriate security review.
Azure Monitor, Application Insights & Log Analytics
Support operational telemetry and troubleshooting. Logging scope, access, and retention are addressed through the vendor-review process.
Azure networking
The Azure environment includes virtual networking and private-connectivity components. The scope of network restrictions is assessed as part of security reviews.
03 / HEALTHCARE REQUIREMENTS
HIPAA & regulatory considerations.
Glazco Technologies LLC operates ReportRocket. Glazco Technologies LLC maintains Business Associate Agreements with Microsoft and OpenAI, and its Azure subscription is governed by a Microsoft Customer Agreement incorporating Microsoft’s Data Protection Addendum.
These contractual materials are part of healthcare security diligence. The applicability of these agreements depends on the covered services, legal entities, and configurations involved in a particular deployment. Agreements alone do not establish overall HIPAA compliance.
No implied certification. ReportRocket does not claim to be “HIPAA certified,” independently HIPAA-audited, SOC 2 certified, HITRUST certified, or ISO 27001 certified without applicable independent supporting documentation.
04 / INFORMATION LIFECYCLE
Handling clinical information responsibly.
Our software processes radiology dictation and generates report text. AI-related requests travel from the local backend through the Azure Gateway to OpenAI.
Dictation & report processing
The Windows application and local backend process dictation and report text; AI requests travel through the Azure Gateway. Data categories and retention details can be addressed through the security review process.
Transmission & credentials
The local backend communicates with the Azure Gateway over HTTPS and uses a desktop-managed bearer token. The Gateway forwards authorized requests to OpenAI over HTTPS. Additional workstation and deployment safeguards are assessed separately.
Audio, transcripts & retention
Retention and handling of audio, transcripts, reports, diagnostic files, and provider-processed data depend on the applicable workflow and configuration. Specific retention and deletion details can be requested through a vendor review.
Access, deletion & third parties
Access permissions, deletion procedures, backups, logging, and provider processing are considered in deployment-specific security assessments.
For information on personal information handling and individual privacy rights, read our Privacy Policy.
For request procedures, see Account & Data Deletion.
05 / SERVICE PROVIDERS
Responsible use of third-party technology.
Microsoft Azure
Cloud platform for the website and Gateway, with associated identity, secret-management, networking and monitoring services.
OpenAI
AI-related processing supporting speech transcription and radiology reporting. Local AI requests route through the Azure Gateway before reaching OpenAI.
Specific processing locations, retention terms, and service coverage depend on the applicable configurations and agreements. This page does not make a blanket geographic-residency or zero-retention guarantee.
Learn about our approach to Responsible AI.
06 / VENDOR DILIGENCE
Security Documentation & Vendor Reviews
Healthcare organizations may request additional information about ReportRocket’s security practices, data handling, and contractual safeguards as part of their vendor assessment process.
Request Security Documentation
To initiate a vendor security review, contact your ReportRocket or Glazco Technologies LLC representative. Do not send patient information through general inquiries.
VENDOR REVIEW CONTACT
Through your existing representative
Through your existing representative
Documentation roadmap
Security review materials may be shared as appropriate to the request and their availability.
Security overviewData flow diagramData retention policySubprocessor informationIncident response summaryHIPAA-related documentationBAA request informationSecurity questionnaires
Sensitive agreements, internal configurations, credentials and restricted security records are not published here.
Explore our Business Associate Agreement Information or Contact & Support for vendor-review guidance.
07 / QUICK ANSWERS
Frequently asked questions.
Does ReportRocket handle protected health information?
ReportRocket is intended for radiology reporting and its dictation and report workflows may process PHI. Handling depends on the enabled workflows, deployment configuration, and applicable agreements.
Where is ReportRocket hosted?
ReportRocket uses Microsoft Azure for its website and Gateway, alongside a Windows desktop application and local backend. Exact processing regions and vendor data residency require documentation.
How does ReportRocket protect access to the application?
ReportRocket uses Microsoft Entra External ID for customer authentication, with token-based access to protected Gateway endpoints. Additional access controls depend on the deployment.
Does ReportRocket work with healthcare organizations that require a BAA?
Glazco Technologies LLC maintains Business Associate Agreements with Microsoft and OpenAI. Healthcare organizations should review specific customer contracting needs, legal entities and covered services directly with the company.
Does ReportRocket use AI to assist with radiology reporting?
Yes. AI-supported report structuring, refinement, optional impressions, and transcription-related workflows are represented in the application source. Clinicians remain responsible for review and final clinical judgment.
How can a hospital request additional security documentation?
Contact your ReportRocket or Glazco Technologies LLC representative to begin a security documentation request.
TRANSPARENCY, BY DESIGN
Built for clinical workflows.
Accountable by design.
ReportRocket is developed and operated by Glazco Technologies LLC.
Explore ReportRocket ↗