Healthcare IT since 2012 · 30+ years in the field

Built to healthcare’s standard. Useful to everyone else.

We have supported healthcare IT since 2012, where an outage is a clinical problem and every access is auditable. That bar shaped our services and our products — and AI now lets a team with 30+ years of experience build them faster than the firms we compete with.

Talk to an engineer What we do

Built to HIPAA & PCI DSS standards · Grand Rapids, Michigan · United States based

01Managed IT & support 02Systems integration 03Data analytics 04Custom software & hardware 05AI development & integration 06Our products

Where this comes from

A healthcare IT company that started building

Rubix has supported healthcare IT since 2012. Years of running clinical and back-office systems — under audit, on call, with no tolerance for a lost record — taught us exactly where off-the-shelf software gives up. We started building the missing pieces ourselves, and AI is what turned that from a side project into a product line: 30+ years of hard-won judgement about what to build, with far less of the cost of building it.

Nothing about that is healthcare-only. Every organization wants mail that can’t leak, a firewall change it can undo, and support sessions a vendor can’t watch. We are still adding products, and the standard they’re held to is the one our clinical customers set.

Serving healthcare since

2012

Hands-on IT experience

30+ years

Service practices

5, one company

Products of our own

3, all self-hosted

Based in

Grand Rapids, Michigan

US-based team, end to end — no offshore tier.

What we do

A full stack of services, from one accountable source

Support, integration, analytics, custom build, AI. Most of our work sits where these overlap: an AI feature is only as good as the data behind it, the data is only as good as the integrations feeding it, and none of it survives infrastructure nobody is watching.

Managed IT & support

We run the systems your organization runs on — and the ones we sold you.

Monitoring, patching, backup and restore testing, identity and endpoint hardening, network and server administration, and a help desk staffed by people who can read the code underneath. Healthcare taught us to treat downtime and audit trails as the same problem.

Patch, backup and restore verification — restores actually tested, not assumed
Identity, endpoint and email hardening; SSO and MFA rollouts
On-premise, cloud and hybrid, including the appliances we ship ourselves
One escalation path: support, engineering and product all answer to the same company

More on this

Systems integration

Make the systems you already paid for behave like one system.

EHR, practice management, ERP, billing, directory, imaging, custom line-of-business apps — connected properly, with the interfaces documented and the failure modes understood. Most of what looks like a software problem is two systems disagreeing about the same record.

Interfaces between clinical, financial and operational systems
Migrations and cutovers planned around a working rollback
Identity and directory integration so access is provisioned once, not four times
Documented interfaces your own team can support afterwards

More on this

Data analytics

Get the numbers out of six systems and into one answer.

Pipelines between line-of-business systems, a modelled warehouse instead of a spreadsheet lineage nobody can audit, and reporting a non-technical owner can read without a translator. This is also the groundwork that decides whether an AI project is feasible at all.

Pipelines and integrations across clinical, ERP, CRM and billing systems
Modelled warehouses with documented lineage and tested transformations
Operational dashboards and reporting your team maintains after we hand it over
Data quality auditing — the unglamorous work that makes the rest true

More on this

Custom software & hardware

When the product you need doesn’t exist, we build it — including the box it runs on.

Applications, appliances and integrations built to fit a workflow rather than the other way round. We ship our own hardware-based products, so a purpose-built appliance is a normal engagement here rather than an exotic one.

Line-of-business applications and workflow tooling
Purpose-built appliances and embedded/edge deployments
Products taken from prototype to something a customer can install and license
Maintained under an agreement afterwards, or handed over with documentation

More on this

AI development & integration

Applied AI that ships into production systems — not a pilot that stalls at the demo.

We build LLM features into software that already has users: retrieval over your own documents, agentic tooling with real permission boundaries, classification and extraction that replaces manual review, and private deployments where the data cannot leave your perimeter. We use the same techniques on our own work, which is how our product roadmap moves as fast as it does.

Retrieval-augmented assistants grounded in your own content, with citations
Agentic automation with tool-level risk gates, audit logs and human approval steps
Provider-agnostic and private deployments — cloud models or models you host yourself
Evaluation harnesses, so accuracy is measured before anyone depends on it

More on this

Our products

We don’t just integrate software — we ship it

Three products of our own, all self-hosted, all in production with customers: mail, network edge and remote support. They are the reason we can talk about encryption, on-premise AI and supporting software on hardware we don’t own from experience rather than from a vendor’s datasheet.

Self-hosted secure email gateway

Secure Message

Outbound message protection, a one-time-code recipient portal, and layered inbound filtering — running as an appliance on the customer’s own network.

secure-message.io Details

Messages and attachments encrypted at rest under keys the customer holds
LLM content analysis for phishing and business-email-compromise, scored on-premise
Recipients read protected mail with a one-time code — no account, no app

Next-generation firewall & UTM appliance

SecureGuard

An object-based, zone-aware firewall whose entire configuration is one document: validated, rendered into every daemon, and applied atomically instead of edited daemon by daemon.

secure-guard.io Details

Policy reads LAN → WAN using named objects, so re-cabling a site isn’t a policy migration
Preview the rendered diff before you commit — and a confirm window rolls back a change that locks you out
Every state is an immutable revision, so rollback is an id rather than a restore
The AI layer throttles suspect traffic on a reputation score before anything gets blocked

Self-hosted remote support & device management

Secure Desk

Remote support for Windows where the relay in the middle cannot watch: the technician’s console and the agent hold their own keys, and the server you run only pairs sessions and forwards ciphertext.

secure-desk.io Details

End-to-end encrypted sessions — the relay forwards AES-256-GCM it holds no key for
No inbound firewall rules to open on the networks you support
Per-session verification code, so both ends can confirm who they’re connected to

Advanced AI development

AI that survives contact with production

Plenty of AI projects demo well and then stall — no evaluation, no permission model, no plan for the data. We build the boring parts that decide whether a model makes it into daily use.

We know they work because we run them on ourselves: an internal AI toolchain does our engineering, support and delivery work faster and cheaper than doing it by hand. That is why features reach our products in weeks, and why our rates compare the way they do.

Our AI practice

Retrieval over your own corpus

Contracts, tickets, drawings, policies — indexed and answered with citations back to the source document, so an answer can be checked.

Classification & extraction

The manual review queue that reads a document and types six fields into a system: modelled, measured against human accuracy, and put behind a confidence threshold.

Agentic workflows with brakes

Tools the model may call, each one risk-rated, with audit logs and a human approval step on anything that spends money or touches production.

Private and on-premise models

Provider-agnostic by default. Where the data cannot leave, the model runs inside your perimeter — the pattern our own mail gateway and firewall already ship.

If a rule, an index or a better schema beats a model, we will tell you — and then build that instead.

Security first

Built to HIPAA and PCI DSS standards, because security is requirement #1

How we run systems

Security is not a phase near the end of our projects — it is the constraint everything else is designed around. Our habits come from healthcare, where a breach is a reportable event and every access to a record has to be explainable, and from handling payment data, where the rules are written down and audited. Both standards now shape everything we build, whether or not a client is bound by them.

HIPAA safeguards as the default design: least privilege, encryption in transit and at rest, audit logging, and access that can be explained after the fact
PCI DSS practices where cardholder data is in scope — segmentation, key handling, patching discipline and change control
Encryption under the customer’s own keys wherever we can put it there, so a compromise of us is not a compromise of you
Self-hosted by default: the fewer parties in the data path, the smaller the attack surface and the shorter the compliance conversation
Backups and restores rehearsed rather than assumed, because an untested restore is not a control

Our own products are the proof: mail scored on-premise, firewall changes reviewable before they land, support sessions the relay itself cannot read.

How we engage

Assess, build, operate

No discovery phase that bills for six weeks and produces a slide deck. You get a recommendation you could hand to another firm — and then, usually, we build it.

Assess

A short paid discovery: we inventory the systems, read the code and the contracts, and come back with what is worth doing, what it costs, and what we would not touch.

Build

Senior engineers, two-week increments, working software at the end of each one. You see progress running in your own environment rather than described in a status report.

Operate

We keep running it — monitoring, updates and support under an agreement — or hand it over with documentation and training if you would rather own it.

Why Rubix

What you actually get

Built in healthcare IT since 2012

Our habits come from an industry where an outage is a clinical problem, every access is auditable and patient data has rules. That standard is the baseline we apply everywhere else — most organizations benefit from it, few are asked to meet it.

Thirty years of experience, aimed at new tools

The team has 30+ years of hands-on IT behind it. AI didn’t give us the judgement about what to build; it removed the cost of building it, which is why our product line keeps growing instead of standing still.

One US company, in Grand Rapids

Rubix is United States based only. Our engineering, delivery and support teams all sit inside one company in Grand Rapids, Michigan — no offshore tier, no follow-the-sun handoff, and nobody on your systems who has never met the people who built them.

We use AI on our own work first

The suite of internal AI tooling we built does our engineering, support and delivery work faster and cheaper than doing it by hand — that is what funds better rates for clients and features that land in weeks rather than release cycles.

We ship software, not just advice

Three products are ours end to end — a mail gateway, a firewall and a remote-support platform, all self-hosted, all with encryption and AI we wrote. The engineers on your project are the ones who wrote them.

Support is the product we’ve practised longest

Before we sold software we spent years supporting other people’s, under agreements that didn’t forgive a slow answer. Our products inherit that: you reach the team that wrote the code, not a tier that escalates into silence.

Security is requirement #1

We build to HIPAA and PCI DSS standards as a baseline, not as a retrofit: least privilege, encryption in transit and at rest, audit trails and tested restores. Healthcare and payment data taught us to design that way; every client gets it, whether their industry demands it or not.

Your data stays yours

Private and on-premise deployments are a default option, not an enterprise upsell. Our own products hold to it: the gateway scores mail without a byte leaving the network, and the support relay forwards traffic it cannot decrypt.

Get in touch

Tell us what you’re trying to fix

Send a short description of the systems involved and what “better” looks like. It goes straight to an engineer who can answer it, and you get back what we would do, what it would take, and what we would leave alone.

Start the conversation

Or email ussales@rubixtechnology.com

Prefer to talk? The number is in the header, on every page.