Security, written for the person reviewing us.

The platform runs on Microsoft Azure in the United States. Production workloads, databases and secrets live in dedicated resource groups, separate from development, with network access restricted to the services that need it. Databases are reachable only on private networks, with public network access disabled.

All traffic is served over TLS 1.2 or higher, with HTTP Strict Transport Security. Data at rest is encrypted by Azure storage and database services. Patient data is never sent over unencrypted channels, including internal service traffic.

Application secrets live in Azure Key Vault, one vault per environment, accessible only from the application's own network and by its managed identity. Secrets are never stored in source code. Deployments authenticate with short-lived federated credentials rather than stored passwords.

Staff access uses Microsoft Entra ID with multi-factor authentication. Access is role-based and scoped to least privilege: clinical roles see clinical data, support roles see what support needs, and administrative access is limited to a small, named group.

Access to protected health information and every clinical action are logged with the user, time and action. Infrastructure and access logs stream to a central log workspace with restricted access.

Public traffic enters through Azure Front Door with a web application firewall in prevention mode, including rate limiting and rules for common attack patterns. Application servers accept traffic only from our own Front Door profile, so they cannot be reached directly.

Databases are backed up automatically with point-in-time restore. Partners receive recovery point and recovery time objectives stated in your agreement.

Dependencies are scanned on every change and builds fail on high or critical advisories. Secret scanning runs on every pull request. Every change reaches production through an automated pipeline, never a manual upload.

If a security incident affects your data, we notify you without undue delay, on the timeline set in your BAA, and we work with you on any notifications you are required to make.

We support customer-commissioned security assessments under a coordinated testing agreement. Ask us for the current scope and rules of engagement before testing.

Health probes monitor every production origin. Partners receive an availability commitment written into your agreement.

We publish the subprocessors that handle partner data, with what each one processes and where. See the current subprocessor list.