What we achieved

Surgery Unified is GDPR and SOC 2 compliant. This reflects how the company is built and how we operate, not a one time exercise.

Reaching this point required formalizing how data is collected, stored, accessed, protected, and monitored. It required documented processes, defined ownership, access controls, and ongoing oversight across product, infrastructure, and internal operations.

What GDPR means and why it matters

GDPR, the General Data Protection Regulation, is the European Union’s privacy law. It exists to give individuals control over their personal data and to hold organizations accountable.

GDPR compliance means transparency around data use, minimization of unnecessary data collection, defined retention practices, and enforceable user rights. Privacy is built into how the platform works.

This matters because SurgeOn serves a global audience, including users in the European Union, and because GDPR represents one of the most rigorous privacy standards in the world.

What SOC 2 means and why it matters

SOC 2 is a security and operations framework based on the Trust Services Criteria. It evaluates whether a company has appropriate controls to protect sensitive data and whether those controls are followed consistently.

SOC 2 compliance means our security, availability, confidentiality, and data handling controls meet industry expectations. This includes access management, monitoring, change management, incident response, and vendor oversight.

SOC 2 exists because most security failures are operational, not technical.

Why this matters for surgeons on SurgeOn

SurgeOn supports professional communication, education, and collaboration. Even when information is not patient data, it remains sensitive.

GDPR and SOC 2 compliance ensure privacy and security are enforced by systems, not left to individual judgment. This protects users as the platform grows.

Why this matters for institutions and partners

Institutions assess risk before partnering. Data protection and security posture are central to that evaluation.

GDPR and SOC 2 compliance reduce friction in review, procurement, and contracting, and signal institutional level maturity.

This is ongoing work

Compliance is not a finish line. Systems evolve. Threats change. Maintaining these standards requires continuous attention.