Security & HIPAA

Your data is safe

Name: Formisoft
Brand: Formisoft

Built for healthcare from day one. Encryption at every layer, strict access controls, US-only infrastructure, and full HIPAA compliance.

AES-256

Encryption

AES-256 at rest. TLS 1.3 in transit. Your data is encrypted in the database, in file storage, and between your browser and our servers.

Data residency

All data is stored and processed exclusively in the United States. No offshore servers, no third-party data processors.

Shared tenancy

Every API request is authenticated, authorized, and scoped to your organization. Cross-tenant access is architecturally impossible.

How we protect your data

Multiple layers of security ensure patient data stays private and compliant.

Admin, Provider, Staff, and Patient roles with strict permission hierarchy. Each team member only sees data relevant to their role.

Every database query is scoped to your organization. Your data is completely separated from every other practice.

Every access, modification, and deletion is logged with who, what, when, and from where. Logs cannot be altered.

Automatic session expiry, secure HTTP-only cookies, SameSite protection, and OAuth with PKCE.

Automated encrypted backups with point-in-time recovery. Your data is protected even in disaster scenarios.

Rate limiting, captcha on submissions, and infrastructure-level DDoS protection included by default.

Industry-standard encryption at every layer of the stack.

AES-256 encryption on all stored data — database, files, and backups

TLS 1.3 enforced on all connections with HSTS preload (2-year max-age)

Encryption keys managed by our cloud provider — we never handle raw keys

Passwords hashed with bcrypt — plaintext is never stored or logged

Digital signatures include tamper-detection hashes

API keys hashed at rest, shown only once on creation

Content Security Policy, XSS prevention, and CSRF protection headers

A signed BAA is included on every plan. We take our obligations as a Business Associate seriously.

Signed Business Associate Agreement (BAA) on every plan

Administrative, physical, and technical safeguards per HIPAA Security Rule

Incident response plan with 72-hour breach notification

Regular risk assessments and security reviews

Data retention and destruction policies

Employee security training and access reviews

No patient data used for AI model training

Minimum necessary standard — data access scoped to what is needed

We're happy to discuss our security practices, sign a BAA, or provide documentation for your compliance team.