CloudHealth maintains a SOC 2 Type II attestation covering the Security, Availability, and Confidentiality Trust Services Criteria. The report period is rolling 12 months, audited annually by an independent CPA firm.
| Area | Control |
|---|---|
| Access | MFA enforced; SSO via SAML/OIDC for enterprise clients. |
| Change Management | Peer-reviewed PRs, automated CI, staged rollouts. |
| Vendor Management | Annual review of all sub-processors handling client data. |
| Vulnerability Mgmt | Weekly scans, quarterly pen-test, 30-day patch SLA (7-day for criticals). |
| BCP / DR | RPO ≤ 15 min, RTO ≤ 4 hrs; annual failover drill. |
Signed NDA required. Request via your CSM or trust@cloudhealth.com.