Security, privacy, and compliance are embedded into our infrastructure, our products, and our culture.
Compliance & Certifications
All production systems run on Amazon Web Services within the United States, leveraging AWS's SOC 2, HIPAA-eligible, and ISO 27001-certified infrastructure.
Security controls are independently audited. Compliance posture is continuously monitored through Vanta.
Heartvue.Proton is developed under a Quality Management System aligned with FDA 21 CFR Part 820. FDA 510(k) pending.
Secure by Design, Encrypted Everywhere
All production systems run on Amazon Web Services within the United States, leveraging AWS's SOC 2, HIPAA-eligible, and ISO 27001-certified infrastructure.
Data is encrypted in transit (TLS 1.2+) and at rest (AES-256). Backups and storage volumes are encrypted using AWS KMS.
All environments are isolated in private VPCs with strict security groups, network ACLs, and no direct public internet access to application servers.
Application Security
We follow secure SDLC practices including code review, static analysis, dependency scanning, and infrastructure-as-code.
Regular vulnerability scanning with risk-prioritized patching. Dependencies are continuously monitored for known CVEs.
Third-party penetration tests are conducted at least annually against our production environment.
Organizational Security
All employees complete security and HIPAA training at onboarding and annually thereafter.
Documented incident response plan with customer notification per contractual and regulatory requirements.
Third-party vendors with access to sensitive data are assessed for security posture and required to meet our standards.
join us
See how Heartvue.Proton and Heartvue.Echo can improve efficiency, consistency, and financial performance at your health system.
