Tenant isolation
Each plan's data lives in its own isolated tenant. Every request is scoped to a single tenant and access is enforced server-side, so one customer can never reach another customer's data.
Encryption
- TLS 1.2+ in transit on every public surface.
- AES-256 encryption at rest for stored data and files.
- Time-limited signed links for any file download.
Access & audit logging
Every request is recorded in a per-request audit log (who, what, when, from where), aligned with the HIPAA Security Rule's audit-control requirement (§164.312(b)). Access to production is least-privilege and reviewed regularly.
Authentication
- Token-based authentication for application users, checked on every request.
- Standards-based machine authentication for system integrations and FHIR data export.
- Single sign-on (SAML / OIDC) available on enterprise plans.
Availability & abuse prevention
Per-customer and per-source rate limits protect every public endpoint, with automatic throttling of anomalous traffic and limits on large export jobs.
Data processing & sub-processors
We use reputable, security-certified cloud infrastructure, email, and billing providers, each under a data-processing agreement. The full sub-processor list and our DPA are available to customers and prospects under NDA.
Incident response
We maintain defined runbooks for data-exposure, availability, and account-takeover events, with customer notification within 72 hours of any confirmed exposure and periodic tabletop exercises.
Compliance posture
The platform is HIPAA-aligned and built to the CMS standards our customers are held to — FHIR R4 Plan-Net (CMS-0057-F), network-adequacy requirements, and Section 508 / WCAG 2.1 AA accessibility. We're happy to walk security and compliance teams through our controls in detail.
Reporting a concern
Security questions or responsible-disclosure reports: security@insurelytix.com. We coordinate on fixes and credit reporters.