What is in place today to protect our clients and the information they share, and what we hold ourselves to next.
| Area | Where we stand |
|---|---|
| Website hosting | Our hosting provider holds SOC 2 Type II, ISO/IEC 27001 and ISO/IEC 27018 certifications and states PCI DSS compliance. |
| Server functions | Run on Amazon Web Services, whose compliance programs include SOC 2, ISO 27001, ISO 27018 and PCI DSS. |
| Encryption | HTTPS on every page, SSL Labs grade A+ (TLS 1.2 and 1.3 only), HSTS, and a full set of browser security headers including a Content-Security-Policy. |
| Insurance | Technology Errors & Omissions and Cyber Liability coverage. Certificate of insurance available on request. |
| Patient information (HIPAA) | HHS has no HIPAA certification program, and we do not claim one. Patient information stays inside tools the client organization covers with its own business associate agreement. Please do not send patient information through this website. |
| Payment cards (PCI DSS) | This website does not accept or store card payments, so PCI DSS does not apply to it. If we accept payments in the future, they will go through a PCI-compliant hosted processor so card data never touches our site. |
| Privacy laws | We follow the principles of GDPR, the California CCPA and the New Jersey Data Privacy Act: we collect only what we need, we do not sell personal information, and we honor access and deletion requests from anyone, except where the law requires us to keep records. See our privacy policy. |
| SOC 2 | Not yet audited. We plan a SOC 2 Type I examination when client engagements require it, followed by Type II. |
Healthcare organizations can request our security questionnaire responses, certificate of insurance and a mutual NDA before any substantive discussion. On the proposal form, check "NDA first" and our mutual NDA arrives by email to sign and return.
How this website protects what you share, including our AWS serverless back end, is described in the security section of the proposal page.