Authenticx

A set of purpose built models is the entire product and the company is specific about them rather than gesturing at artificial intelligence generally. Named models cover conversational friction, generative transcription and summarisation, agent quality, sentiment, unsupervised topic discovery, compliance monitoring and adverse event signal detection, and the company states they are trained exclusively on healthcare data using its own labelled corpus.

There is no services layer, no content library and no workflow product underneath: the deliverable is what the models found. The healthcare specificity is also a real technical position rather than a marketing one, since the vocabulary, the compliance obligations and the consequences being predicted differ from any other industry's contact centre.

Nothing acts on a patient. The platform reports to leaders, guides an agent during a call and scores interactions afterward, and humans decide everything downstream. Two oversight questions belong on the record, one shared and one specific.

The shared one is employee evaluation: interactions are scored against defined rubrics and agent quality is a named model output, which is a model assessing a person's professional performance, and nothing published describes whether an agent can see or contest a score or whether it feeds employment decisions. The specific one concerns adverse events.

If a model flags a possible adverse event in a call, what happens next is not an analytics question but a reporting one, and no published material describes the escalation path, the timeline, or who owns the decision that a flag is or is not reportable.

More specific than most vendors in this segment and still not verifiable. The company names its individual models, describes the summarisation component plainly as a generative large language model, and states that its training data is proprietary and healthcare labelled, which is a clearer account of provenance than most.

What is absent is anything that would let an outside party check it: no architecture, no validation methodology, no accuracy or error rates, no publication and no independent evaluation. The claim that its friction model is the only commercially available one of its kind tied to return on investment is a market positioning statement rather than a technical one and is not graded as evidence of anything.

A longer operating history and a better customer roster than most in this segment, and nothing published that a third party could examine. A named pharmaceutical customer using the platform for adverse event signal identification is a meaningful reference, since that is a use with regulatory consequence rather than a convenience feature, and the company reported doubling customers and recurring revenue in the year before its Series B. Against that, two passes located no peer reviewed publication, no independent evaluation and no published performance figure for any model.

The specific gap that matters most is adverse event detection sensitivity, because that is the one output where being wrong has legal consequences rather than commercial ones, and no number is published.

Two passes located no retention position, no minimisation statement and no policy on secondary use. One question follows directly from how the company describes its own advantage: the models are said to run on a proprietary healthcare labelled dataset, and a labelled dataset of healthcare conversations was built from somebody's conversations.

Whose, under what basis, whether the labelling was done on customer data, and whether one customer's calls improve models sold to another are all unaddressed. This is the same question recorded against Azra AI's training corpus and it recurs wherever a vendor names proprietary labelled data as its moat.

An unusual situation worth stating precisely: HIPAA appears in this company's material as a product feature rather than as a compliance posture. Compliance monitoring is one of the named model outputs, meaning the platform listens for potential privacy problems in other people's conversations. What two passes did not locate is the company's own published statement of HIPAA compliance, Business Associate Agreement terms or a privacy page.

Agreements certainly exist, since covered entities and pharmaceutical manufacturers could not otherwise use it. A vendor selling privacy compliance detection is the one best placed to publish its own, and the gap is more conspicuous for it.

A real attestation, of the weaker type, and old. The company completed a SOC 2 Type 1 examination covering security and confidentiality criteria, announced in February 2021, and named the examining firm, which is better disclosure practice than most vendors manage. Two distinctions decide the grade.

A Type 1 examination tests whether controls are suitably designed at a single point in time, whereas a Type 2 tests whether they operated effectively across a period, and the second is what a buyer is actually asking about. And the examination is now five years old with no current report located.

This index has graded three comparable vendors in this same segment and the resulting scale is instructive: an audited portfolio naming standard versions and report type earns an A, an unspecified badge earns a B, a dated Type 1 earns this C, and an unevidenced assertion of being secure earns a D.

No clearance, authorisation or submission located and none needed for conversation analytics. The regulatory frame that does apply is different from anything else recorded in this segment, and it is pharmacovigilance rather than device law. Pharmaceutical manufacturers carry mandatory obligations to collect and report adverse events they become aware of, and a manufacturer's contact centre is a recognised source of such reports.

Software that identifies adverse event signals inside those calls therefore sits inside a regulated reporting chain, and the questions that follow are about detection sensitivity, timeliness, documentation and who is accountable for a missed signal. None of them is addressed in published material, and a buyer in pharmaceutical services should establish all four before deployment.

Nothing published, and three exposures stack. First, speech and language model performance varies with accent, dialect, first language, age and emotional state, and this is now the fifth record in this index carrying that exposure unexamined while operating on patient conversations.

Second, the platform scores agent performance against rubrics, so any variation in how well the models understand a given caller propagates into the evaluation of the employee who handled that caller, which is the compounding effect first recorded against Laguna Health and this is its second instance.

Third and most consequential, adverse event detection has an asymmetric failure mode: a missed signal is invisible to everyone, including to the manufacturer whose reporting obligation does not diminish because software failed to surface it. Publishing sensitivity for that model specifically, even an unflattering figure, would be worth more than any general assurance.

The integration story is deliberately aimed at the customer relationship and contact centre stack rather than the clinical record, which is the correct target for this product: the conversations it analyses happen in telephony and messaging systems, not in a chart. The agent assist product is published through the Salesforce marketplace, which is a named and verifiable distribution route rather than a claimed integration, and the platform ingests voice, chat and email.

Two passes located no named telephony platform, no record system integration and no interoperability standard. Graded C on what is verifiable, with the note that absence of clinical record integration is a design choice here rather than a shortfall.

No published architecture, hosting region or residency commitment located in two passes. The question that matters most for this product is retention rather than location: the platform's value comes from analysing conversations in aggregate over time to find recurring system level patterns, which implies holding a substantial historical corpus rather than processing and discarding.

That is a legitimate design and it means the accumulated store is large, sensitive and long lived, so how long recordings and transcripts persist, and whether they are separated by customer, are the first questions a security reviewer should ask.

No pricing, pricing mechanism or basis of charge located. Funding is a 20 million dollar Series B in January 2023 led by Blue Heron Capital with a long list of participating regional and sector investors, and no subsequent round was located, which makes the most recent visible financing roughly three years old.

That is worth a buyer's attention on supplier continuity grounds under the Behold.ai precedent, particularly for a product whose value compounds with the length of the conversation history it holds, since switching vendors means losing the accumulated baseline as well as the tool.

The buyer span is the distinctive feature and it is wider than anything else in this segment. Pharmaceutical manufacturers use it for adverse event signals and patient support programme insight, insurers for member experience and retention, and provider contact centres for access and agent quality, which means one platform serving three parts of the industry that rarely buy the same software. Channels cover voice, chat and email rather than telephony alone.

Clinically it is not tied to a specialty, since the subject is the interaction rather than the condition, though the outcomes it connects to, therapy discontinuation and prescription fills in particular, point at chronic and specialty medication populations. Held at B because it is United States focused and because depth in each of the three buyer types is asserted rather than evidenced beyond one named pharmaceutical customer.