Security FAQ

Where is data hosted?

AWS us-east-1 (primary) and us-west-2 (DR). Multi-AZ Postgres with encrypted snapshots to a separate account.

Is data encrypted?

Yes. AES-256 at rest (KMS-managed keys, 90-day rotation) and TLS 1.2+ in transit. Field-level encryption for identifiers.

Who has access to PHI?

Only workforce members with a documented job need. Access is provisioned via SSO groups, reviewed quarterly, and revoked within 4 hours of role change.

Do you support SSO?

SAML 2.0 and OIDC for enterprise clients. SCIM provisioning available on the Full Service tier.

How are backups handled?

Automated daily snapshots, 35-day retention hot, 7-year cold. Restore drills run quarterly.

What is your incident response SLA?

Sev-1 acknowledgement within 15 minutes 24/7. Breach notification to Covered Entities within 72 hours.

Do you conduct pen-tests?

Annual third-party pen-test plus quarterly internal tests. Executive summary shareable under NDA.

Sub-processors?

Full list available on request — includes AWS, Twilio, Stripe, and dispensing pharmacies (each covered by BAA).