Verifiable

The model now drives a core module. CredAgent, which leads the home page and powers the CVO service, runs the credentialing workflow as a set of agents that pull CAQH data, read attestations, look up state requirements, run license and board certification verification, and compile the committee packet, processing thousands of files in parallel with three human checkpoints. The company's data processing addendum confirms machine learning and agentic systems perform part of the service.

The platform carries other value that stands without the models (direct primary source connections, continuous monitoring, the Salesforce application and the API), but agentic packet assembly at that volume does not exist without them. No model is named or described, so the kind of model doing the work is unknown.

Human checkpoints are published, and the company's marketing also sells the result as correct. CredAgent reduces about 150 agent steps to three human checkpoints (data review, verification, packet), with step-by-step decision logs and a cited primary source for each verification, and customers can configure the agent's rules to their own and NCQA policies.

Against that, the home page says the configuration ensures "every automated decision meets your unique risk standards", cites a "0% error rate for file quality review" for the CVO service, which it says is powered by CredAgent, and the company's Salesforce listing promises "error-free, fast verifications at scale". Those are correctness universals, and whatever the review mechanism, a team that believes them will not staff the checkpoints properly.

The company's own data processing addendum says the opposite: outputs of its AI-assisted processing "may be incomplete or inaccurate", must not be the sole basis for credentialing determinations, and the customer remains responsible for reviewing them.

The workflow is described and nothing that produces the output is identified. The CredAgent page lays out the agent's steps, from pulling CAQH data and reading attestations to verifying licenses and compiling the packet, and the three checkpoints where staff review; the data processing addendum says machine learning and agentic systems assist in the service. No model, supplier, version or update practice is named, and the accuracy language on the home page has no method behind it.

The architecture is described and no model provider is named. The company publishes a subprocessor list with each party's function and location and commits in its data processing addendum to post changes ten days before a new subprocessor starts: Amazon Web Services for hosting in Northern Virginia, Cloudflare, Google (including Drive for documents that may hold personal data), Intercom for support in the US and UK, and email, payment and analytics services.

The addendum also says subprocessors may provide AI-assisted processing, yet no model or AI provider appears on the list, so either the models run in house on the named host or the model layer is missing from it. Several entries (a blockchain claims network, a breach lookup service) point to older products, which raises whether the list is current.

Vendor reported figures with no method, denominator, baseline or period, and testimonials without organizations. The home page claims seven figure cost savings, a 98 percent increase in packet turnaround efficiency and a 100 percent NCQA scorecard and audit pass rate, and for the CVO service three day turnaround and a 0 percent error rate for file quality review; the CredAgent page claims ten times team productivity and up to 98 percent faster turnaround. Customer quotes name individuals and titles, one citing a 67 percent reduction in turnaround, but no organization. NCQA certification tests the verification process, not these figures.

Categorical commitments are published in the data processing addendum (effective 29 April 2026), which reaches the service. Customer personal data is not used to train or fine-tune generalized models for any third party or other customers; only de-identified and aggregated data may be used to maintain and improve the services; data is encrypted at rest and in transit; and at the end of the contract it is deleted or returned at the customer's option, unless law requires retention.

No retention window applies during the contract (how long verification files, supporting documents and the agent's workflow and citation logs are kept), and the training clause leaves open whether a customer's own data tunes a model used only for that customer. Safety engineering for the agents, meaning how an ambiguous source or near match is handled, is not published.

A substantive privacy document reaches the service, and no HIPAA status or scope position is stated. The data processing addendum (effective 29 April 2026) governs customer personal data processed to perform the services, including AI-assisted processing, subprocessors, security measures and deletion at termination; the privacy policy covers the website and account holders.

Neither, nor the home, CredAgent or subprocessor pages, mentions HIPAA, protected health information or business associate status, and the company does not say its product handles no patient data, so the provider data scope route is not open. The company's 2022 SOC 2 post names HIPAA only as a regulation the industry faces. Most of what flows through is provider identity data, but health plans and provider organizations are the customers and the service ingests their files.

The company presents a SOC 2 Type 2 as its own: a March 2022 post on its blog says it became SOC 2 Type 2 compliant that month, and the data processing addendum commits to give a customer its most recent SOC Type II report on request, with further information owed if the report is more than a year old. That leaves currency open, since the only dated statement is from 2022 and the addendum says "if available".

The auditor, period and product scope are not published, the site links no trust center, and the company makes no HITRUST, ISO 27001 or penetration testing statement. The addendum lists baseline security measures (encryption, network controls, incident response).

There is no device claim, and none applies: the product verifies clinicians' credentials and assembles files for a credentialing committee, and does not diagnose or inform treatment. The regime that governs the work is credentialing regulation. The company states NCQA Credentials Verification Organization certification and links its NCQA report card from the home page, and claims a 100 percent NCQA audit pass rate. That certification is conformance to the standard a delegating health plan relies on, not a regulatory pathway.

Governance is described as a customer configuration, with no evaluation behind it. The home page offers custom governance, meaning the agent can be set to follow a customer's business rules and NCQA policies, and calls the product fully transparent AI on the strength of decision logs and cited sources; the data processing addendum makes the customer responsible for reviewing AI outputs.

There is no responsible AI framework with named process, no model evaluation, no error taxonomy and no subgroup result. The exposure is specific: identity and exclusion matching errors tend to cluster on common, transliterated and compound surnames, where a false match stalls a clinician's credentialing and a missed one admits an excluded practitioner.

Mechanisms exist that let a customer challenge an output, and the contract places the risk on the customer. CredAgent keeps step-by-step decision logs with a cited primary source for each verification and stops at three review checkpoints, so a wrong result can be traced.

The data processing addendum states that AI-assisted outputs may be incomplete or inaccurate, must not be the sole basis for credentialing determinations, and remain the customer's responsibility to review, and that preview features are provided as is. The home page's 0 percent error rate for file quality review has no measure, period or volume, so it does not amount to a published error rate. No warranty, indemnity or remediation tied to a verification is published, and no route is described for a clinician wrongly failed.

Named systems with read access and one directional exchange. The product runs as a native Salesforce application, so credentialing and monitoring sit inside a customer's own Salesforce organization, and the company links its Salesforce marketplace listing. For everyone else it publishes open API documentation with provider, credentialing request, dataset scan, monitoring, alert and webhook endpoints; a credentialing request can be routed to the CVO team or self managed. CredAgent's steps begin by pulling CAQH data. No clinical record system integration is named, and none is claimed.

Options and residency are stated; isolation and the AI processing path are not. The product is offered as a native Salesforce application or as an API powered platform. The privacy policy says all personal data is processed and hosted in the United States, and the public subprocessor list names Amazon Web Services as the host, storing data in Northern Virginia, with Cloudflare for network services.

Tenant isolation is not described, the list includes a support platform located in the US and the UK, and nothing says where agent processing runs or which data leaves a customer's Salesforce organization when the Salesforce application calls the platform or the CVO service.

No published rates, but the commercial structure is disclosed with useful clarity: customers can license software to bring credentialing entirely in house, or use the vendor's NCQA compliant verification organization services, or combine them. The company frames the in house option around control, visibility across clinical and operations staff, and reduced compliance risk. Knowing both models exist and what each is for lets a buyer scope the conversation before pricing.

Broad across the provider data lifecycle: credentialing software, the CVO service, ongoing monitoring, payer enrollment, licensing, provider intake and roster management, sold to health and dental plans and provider organizations, and, the company says, to pharmacy, recruiting and staffing and life sciences organizations. The company says it scales from 100 providers to millions.

Coverage is administrative rather than clinical, and the practical fit question is often whether a buyer runs Salesforce, since the native application is the lead deployment, though an API platform is also offered.