That's great you're compliant with those! For HIPAA, do you enter into a BAA with prospective customers who deal in HIPAA data (PHI)?
EDIT>> The implication being that you may not be HIPAA compliant if you don't enter into a BAA. IANAL, so I defer to the experts, but I figured I'd ask the original question anyway. If you are above board on all of this, I will definitely take this tool to my boss.