ISO 27001
Certified under ISO/IEC 27001:2022. Independently audited annually.
Security
Patient data, protected by default.
Built for practices that handle PHI every day.
Encrypted everywhere
At rest and in transit, on every connection.
Access by role
Admin, Provider, and Staff. Only admins manage the team.
An audit trail
Every change and sensitive read, with who, when, and from where.
Safeguards
- Encryption at rest
- AES-256 encryption on the PostgreSQL database, its backups, and file storage for uploads.
- Encryption in transit
- HTTPS only, with TLS 1.2 as the minimum and TLS 1.3 supported. Database connections require TLS.
- US hosting
- The application, database, and file storage run on AWS in the United States (us-east-1).
- Practice isolation
- Every record belongs to one practice, and each request is checked against the user's membership and role.
- Uploaded files
- Patient uploads are private and served through signed links that expire after an hour.
- Passwords and webhooks
- Passwords are hashed with bcrypt. Outgoing webhooks are signed with HMAC so you can verify them.
- Backups
- Automated daily database backups kept for 7 days, with a standby database in a second availability zone.
- Monitoring
- Account activity is recorded with AWS CloudTrail and watched by Amazon GuardDuty.
- Business Associate Agreement
- Included at no extra cost and accepted in Settings under Compliance.
Certified infrastructure
ISO 27001 and ISO 27799 certified, with HIPAA safeguards on top.
ISO 27799
Certified under ISO 27799:2016. Health informatics security management for healthcare organizations.
HIPAA
Administrative, physical, and technical safeguards for all patient health information.
Questions
Questions about security?
We can walk your compliance officer through how Formisoft handles PHI.
BAA included · We set up your front desk