HIPAA-Ready Error Tracking
GlitchTip provides HIPAA-aligned error monitoring for covered entities and business associates building software in regulated environments.
Business Associate Agreements (BAA) are available on a Large plan, hosted on app.glitchtip.com (US — DigitalOcean NYC1, New York).
Is GlitchTip Right for your Application?
If your application generates error events or logs that may contain Protected Health Information (PHI), you need a monitoring vendor willing to sign a BAA and operate under HIPAA's Security Rule requirements. GlitchTip is designed for teams who also want:
- An open-source, auditable codebase with no hidden data pipelines. You don't need a lawyer to understand our license.
- A vendor that does not use your data to train AI models
Security Controls
GlitchTip's hosted infrastructure is designed to align with the HIPAA Security Rule: covering encryption, access controls, audit trails, backup retention, and breach notification. For a full breakdown, see our Security & Architecture page.
Sub-Processors
If you have signed a BAA with us, Burke Software acts as your business associate for the data your applications send to GlitchTip. Without a BAA, do not send PHI. Only DigitalOcean receives PHI under a BAA; keep PHI out of the paths noted below.
| Sub-Processor | Purpose |
|---|---|
| DigitalOcean (NYC1) | Infrastructure & hosting (BAA in place) |
| Mailgun | Transactional email, not covered by a BAA. Alert emails include issue titles, so keep PHI out of error messages or turn off email alerts for those projects |
| Stripe | Payment processing (billing data only, no PHI) |
| Cloudflare | DNS only on the US instance (app.glitchtip.com), no access to request contents |
| Chatwoot | Support email and chat, not covered by a BAA. Never include PHI in support messages |
Plan Options
Hosted Plans
All hosted plans run on the same security-controlled infrastructure: encryption at rest, TLS in transit, private VPC on the US instance, and 90-day data retention by default. The difference is contractual:
- Free, Small, Medium: HIPAA-aligned security controls in place, but no BAA is available. Suitable for applications that never send PHI to GlitchTip.
- Large: BAA available. Required if your organization is a covered entity or business associate that must have a signed BAA with all vendors handling PHI.
To get a BAA in place on the Large plan, contact support@glitchtip.com.
Frequently Asked HIPAA Questions
Yes. BAAs are available on our Large plan. Contact support@glitchtip.com to get a BAA in place before processing PHI.
No. BAAs are currently available only for the US instance (app.glitchtip.com) hosted on DigitalOcean NYC1. The EU instance is not covered under a US BAA.
Yes. GlitchTip is open-source and can be self-hosted on your own HIPAA-compliant infrastructure. You are responsible for your own security controls, BAAs with sub-processors, and compliance obligations.
Burke Software will notify affected customers without undue delay and no later than 72 hours after becoming aware of a breach, in alignment with GDPR and HIPAA requirements.
No. Support email and chat are not covered by a BAA. Describe the problem without PHI, for example by linking to the issue in your GlitchTip account.