What is in the system
Provider names, NPIs, license and registration numbers, expiration dates, malpractice policy details, CAQH IDs, payer application statuses, reference numbers and your notes about follow-ups. Documents you choose to attach — licenses, COIs, payer letters.
What is not
No patient names, no patient records, no claims data, no clinical information. Nothing that meets the definition of protected health information.
This is a product decision, not an oversight: no patient data means no PHI, and no PHI is the reason there is no BAA to negotiate, no HIPAA security review to schedule, and no compliance sign-off standing between you and a trial.
How it is protected
Data is isolated by organization at the database level — a Billing Co client’s records are not reachable from another client’s login, enforced the same way regardless of plan. Encryption in transit is standard for the entire stack. Documents are stored with the same per-organization isolation as everything else, capped at 10MB per file, with total storage by plan: 1GB (Solo), 5GB (Practice), 20GB (Billing Co). Email alerts and the weekly digest are sent through Resend.
Your data on the way out
Export everything to CSV at any time, including after cancelling. There is no export fee and no request process.
What if the company shut down tomorrow
This is a fair question to ask about any vendor, and a more pointed one when the vendor is a single founder. There is no scenario in which your data becomes unreachable — export to CSV works the same way whether the product is thriving or winding down, and it is not a feature that depends on anyone being available to process a request. If Sokndall ever stopped operating, the honest answer is that support would stop, not that your records would disappear or lock you out.
That is a smaller promise than an enterprise vendor with a business-continuity clause in a contract can make, and it is worth being clear about the difference rather than implying otherwise.