Security & compliance
A credentialing file is the most sensitive record you keep.
This page is written for whoever completes your vendor assessment, not for a marketing claim. Every control below has documentation attached to it, and we send it during evaluation rather than after signature.
AES-256At rest & in transit
RBACRole & facility scoped
ImmutableAudit log
99.9%Uptime target
01Control register
Eight controls, and what we send to prove each one
01
Role-based access control
Permissions scope to facility, department and function. A specialist, a department chair, a compliance officer and a provider each see only their own surface of the file.
Access matrix
02
Immutable audit logging
Every view, edit, verification and approval is attributed to a named user with a timestamp, and cannot be altered afterwards.
Log export
03
Encryption in transit and at rest
TLS 1.2 or higher in transit, AES-256 at rest, encrypted backups, and key management separated from application access.
Architecture summary
04
Single sign-on and MFA
SAML 2.0 with SCIM provisioning against your identity provider; multi-factor authentication enforced for administrative roles.
Configuration guide
05
Backup and recovery
Point-in-time recovery with tested restore procedures and documented recovery objectives.
RPO / RTO statement
06
Personnel and vendor controls
Background-checked staff, least-privilege internal access reviewed quarterly, annual security training, documented subprocessor list.
Access review log
07
Incident response
A documented response plan with defined notification timelines for confirmed incidents affecting customer data.
IR policy
08
Secure development
Peer-reviewed changes, dependency scanning, and annual third-party penetration testing.
Pen-test summary
Audit trail
What an audit trail actually looks like
Every action on one file, attributed and timestamped, from application received to monitoring scheduled — the view a surveyor is shown, exported per provider.
Who acted
ProviderPlatformNamed staffException
02Regulatory
Built for what you are surveyed against
Workflows follow the verification and file-completeness expectations accreditors and payers apply, so your program documentation matches what a surveyor actually asks for.
Send us your security questionnaire →EncryptionAES-256 · TLS 1.2+
Access controlRole & facility scoped
Verification evidenceSource response stored
Joint Commission exportsPer provider
CMS & payer documentationSupported
Exclusion screeningMonthly
Control documentation, subprocessor list and penetration-test summaries available under NDA.