echowin partners with Sythe Labs to build its HIPAA compliance program

BOULDER, Colo., November 5, 2026. echowin partnered with Sythe Labs to build a HIPAA compliance program, bringing cybersecurity expertise directly into its development process. Sythe identified compliance gaps, explained the risks and guided echowin's developers through the changes needed to address them.

Read the case study on sythelabs.com.

Why echowin started the work

A customer asked echowin for HIPAA compliance. At the time echowin had developers but no security team and no formal compliance program. Rather than hand the problem to an outside team and wait for a report, echowin brought in Sythe Labs to work inside its development process.

How the work was split

Sythe identified the control gaps and the risk behind each one. For each gap it gave echowin's developers the context, kept them updated on the work, and laid out the steps to close it. echowin's developers made the remediation changes in the product, and Sythe made some changes directly.

That split meant the people who build echowin every day were the ones changing it, so the fixes went through the same codebase and review as everything else the team ships.

Penetration testing alongside it

Sythe Labs also ran a separate penetration test of echowin's platform. Over two weeks, Sythe examined each layer of the platform and found a handful of minor misconfigurations, which were resolved. Sythe announced the results in July 2025: Sythe Labs completes pentest for echowin's AI platform.

What's next

Security work continues in the next version of the platform. Masking sensitive personal information in transcripts and recordings, and a tamper-evident audit log of who changed or viewed what, are both in scope.

"We didn't have a security team when a customer asked us for HIPAA compliance, and we didn't want a list of findings nobody would act on," said Ashish Ghimire, co-founder and COO of echowin. "Sythe Labs showed our developers exactly what needed to change and why, and our team made those changes in the product. That's how we want to keep handling security as the platform grows."

Compliance requirements

For questions about HIPAA requirements or Business Associate Agreements, contact the echowin team at echo.win/contactus.

About echowin

echowin is a platform for building AI phone and conversation agents. Builder-operators configure their agent's instructions, knowledge, tools and workflows, and deploy it on phone, SMS, chat and other channels, while echowin runs the speech, model and telephony layers underneath. Building is free. For more information, visit echo.win.

About Sythe Labs

Sythe Labs is a cybersecurity firm in Boulder, Colorado, offering managed compliance and penetration testing. Learn more at sythelabs.com.

Media contact: press@echo.win