Access control
Access is limited to people who need it, for as long as they need it, and reviewed regularly.
Security & compliance
Healthcare-grade protection, verified by outsiders.
We handle sensitive operational and healthcare data. Our controls are certified, independently audited, and practiced by every person on the team.
ISO/IEC 27001:2022Information security management certification
HIPAA compliantInfrastructure and safeguards for healthcare data
Annual auditsThird-party audits of technology and applications
HIPAA-certified staffEvery team member
How we protect data
Controls that run through the whole lifecycle
Monitoring and audit trails
Meaningful activity is logged so that changes can be traced and questions answered.
Careful data handling
Data is collected for a purpose, kept as long as needed, and handled under written agreements.
Secure development
Peer review, validation of inputs, and secure coding practices for every change.
Healthcare-specialized DevOps
Infrastructure operated by engineers experienced in regulated, high-availability environments.
Resilience and recovery
Backup, recovery, and incident-response planning are part of how we operate.
Working with PHI
Shared responsibility, clearly written down.
When our work involves protected health information, we operate under the appropriate written agreements, including business associate agreements where HIPAA applies, and agree on scope, access, and handling before any data is shared.
Please don’t send PHI through this website or our contact forms. Tell us what you need and we will arrange a secure channel first.
Have a security questionnaire or need our documentation for a vendor review? Ask us. We’re glad to help.
Questions about security?
Our team can answer vendor questionnaires and walk through our controls.