Skip to main content
Enterprise-Grade Security

Security Without Compromise

Your clients trust you with their most sensitive information. We protect that trust with enterprise-grade security that exceeds industry standards.

Last updated: December 2025

Security at a Glance

Key security metrics that matter for your practice

AES-256
Encryption Standard
99.9%
Uptime SLA
24/7
Security Monitoring
<48hrs
Critical Patch Time
HIPAA Compliant
HITRUST CSF Ready
GDPR Compliant
State Privacy Laws

Comprehensive Security Features

Enterprise-grade security measures designed specifically for healthcare

End-to-End Encryption

All data encrypted using AES-256 at rest and TLS 1.3 in transit.

Secure Infrastructure

HIPAA-eligible cloud hosting with enterprise-grade controls.

Comprehensive Audit Logging

Every PHI access logged with timestamps and user identity.

Role-Based Access Control

Granular permissions ensuring minimum necessary access.

Multi-Factor Authentication

Required MFA for all accounts and admin access.

Automatic Session Management

15-minute inactivity timeout with secure session handling.

Infrastructure Security

Built on Enterprise-Grade Infrastructure

Your data is protected by the same security measures used by major financial institutions

Cloud Provider

HIPAA-eligible infrastructure with signed BAAs

Network Security

WAF, DDoS protection, and intrusion detection

Data Isolation

Dedicated VPC with network segmentation

24/7 Monitoring

Automated threat detection and response

Multi-Layer Encryption

In Transit:TLS 1.3 with perfect forward secrecy
At Rest:AES-256 with AWS KMS key management
Application Layer:Field-level encryption for sensitive data
Backups:Encrypted before geographically distributed storage

Comprehensive Audit Logging

Every access to Protected Health Information is logged and retained for 6 years, ensuring complete accountability and HIPAA compliance.

User Identity

Who accessed the data

Timestamp

Exact time of access

Action Type

Read, write, update, or delete

Data Accessed

Specific records viewed

IP Address

Location of access

Device Info

Browser and device details

Tamper-Evident: All audit logs are cryptographically sealed and cannot be modified after creation, ensuring complete integrity for compliance audits.

Common Questions

Security Questions Answered

Everything you need to know about how we protect your data

Questions About Our Security?

Our security team is available to discuss our security measures, provide our security whitepaper, or schedule a security review call.

Security & Vulnerabilities: security@therafocus.com

General Legal: legal@therafocus.com