Built to be trusted with patient care.

• Infrastructure security

  • Hosted on Amazon Web Services (AWS)
  • Customer data encrypted at rest
  • Data encrypted in transit over public networks
  • Encryption keys managed with AWS Key Management Service
  • Network traffic restricted by security groups
  • Infrastructure configured as code

• Access control

  • Multi-factor authentication for system access
  • Least-privilege, role-based access
  • Periodic access reviews
  • Access removed promptly when people leave
  • Password policy enforced

• Product security

  • Every change peer-reviewed before release
  • Changes tested before they reach production
  • Network and web application vulnerability scans, twice a year
  • Penetration testing every year
  • Vulnerabilities fixed under a documented policy

• Monitoring and response

  • Infrastructure monitored, with alerts to the team
  • Security activity logged and reviewed
  • Documented incident response plan
  • Business continuity and disaster recovery plan

• Organizational security

  • Background checks for new team members
  • Security training at hire and every year
  • Information Security Policy, reviewed every year
  • Code of Conduct acknowledged by every team member

• Risk and vendor management

  • Risk assessment every year, and after major changes
  • Inventory of every third-party vendor
  • Vendors held to our security requirements
  • AWS's own SOC 2 report reviewed every year

Subprocessors

Third parties that store or process customer data on Medlog's behalf.