Security Controls
Information Security
Our comprehensive information security management system (ISMS) and robust security controls are crucial in safeguarding practitioner and patient data. We also ensure that our subcontractors, third parties, and subprocessors are carefully vetted to maintain high security standards.
* Physitrack is registered with the United Kingdom Information Commissioner's Office under number ZA396165.
* Below, find a high-level summary of some of the security controls which we have in place. Because our philosophy is to continually improve, these controls are reviewed and - where possible - improved annually.
Controls that protect confidentiality
We ask and store as little as possible and have designed our platform and operations in line with the EU's strict GDPR principles. Non-EU subprocessors have Standard Contractual Clauses in place.
All data sent to and from our platform is encrypted in-transit and encrypted at rest. See our SSL Labs score.
For Physitrack Telehealth, all traffic between clients and Dolby® is encrypted. All media between the client and server use standard protocols (DTLS/SRTP) encrypted with 128 bit AES.
TLS encryption is used for inbound and outbound email.
On top of all the controls that protect the confidentiality, integrity and availability of PHI, we have BAAs in place with third parties and subcontractors who have access to PHI.
Access to patient data is severely restricted, and any person or party that (potentially) has access to patient data is bound by confidentiality agreements.
Physitrack runs physically isolated platforms in different data centers around the world to avoid leaking data outside jurisdictions as much as reasonably possible.
- Every year, we hire an accredited third party to perform grey box penetration tests on our platform. This includes testing for vulnerabilities against OWASP-threats
- Every week, an independent third party scans our platform for known vulnerabilities.
Any uncovered vulnerability is prioritised, resolved and deployed as soon as possible following discovery.
ISO 27001 & ISO 27018 certification
ISO 27001 (formally known as ISO/IEC 27001:2013) is a standard for Information Security Management Systems (ISMS).
An ISMS is a framework of policies and procedures that includes all legal, physical and technical controls involved in an organisation's information risk management processes with the aim of keeping information secure.
Data is hosted and processed inside AWS. AWS holds SOC and ISO 27001 certification.
* Physitrack has an ISMS in place, with roles of Information Security Manager and Data Protection Officer appointed. Our adherence to the ISO requirements has been confirmed by the independent audits and is supported with the ISO27001 (Information Security) and ISO27018 (Data Protection in Cloud) certificates.
Our network security architecture consists of multiple security zones. We monitor and protect our network, to make sure no unauthorised access is performed using:
- a virtual private cloud (VPC);
- a bastion host or VPN with network access control lists (ACL’s) and no public IP addresses;
- a firewall that monitors and controls incoming and outgoing network traffic;
- IP address filtering.
Our infrastructure is hosted inside AWS. Physical and environmental security related controls for our servers, which includes buildings, locks or keys used on doors, are managed by AWS:
“Physical access is strictly controlled both at the perimeter and at building ingress points by professional security staff. Authorised staff must pass two-factor authentication a minimum of two times to access data center floors."
Your privacy is of utmost importance to us. As part of our commitment to safeguarding your data, we do not store any bank or credit card information on our servers. Instead, we rely on PCI-DSS-certified third-party payment services to handle all transactions. They are industry leaders in payment security and compliance, ensuring that your payment information is processed securely and efficiently.
For payment processing, we utilise the following trusted services:
- Adyen is a leading payment service known for its advanced technology and compliance with PCI-DSS standards. You can review their privacy practices on their privacy policy page.
- Stripe is a globally recognised payment platform known for its robust security measures and compliance with PCI-DSS standards. You can learn more about their privacy practices by visiting their privacy policy page.
- GoCardless specialises in direct debit payments and adheres to the highest security standards. Detailed information about their data protection and privacy policies can be found on their privacy policy page.
- Chargebee offers a comprehensive subscription billing platform with robust security protocols. Please refer to their privacy policy for more details on how Chargebee handles your data.
Our commitment to your data security is further strengthened by our partnerships with these reputable trusted services. Together, we implement a comprehensive array of security measures, ensuring that your financial information is managed with the utmost care and security.
Controls that protect integrity
We use industry-best practice development processes both for our applications and our infrastructure.
Code is under version control (Git), and features/fixes are developed in separate branches.
Before being reviewed by a peer, code has to pass thousands of automated tests and is scanned for known security issues. The fix/feature is then manually tested (QA) and merged to the master code branch.
We have separate testing, staging and production environments.
Controls that protect availability
High-availability databases
Our data is processed on AWS RDS databases (Postgresql) and replicated in a high-availability configuration.
Daily backups
Every day, our databases are backed up and stored encrypted. Backups are verified regularly.
24/7 monitoring
Our virtual NOC monitors our infrastructure 24/7/365 and both our SRE team and our entire development team are alerted if infrastructure metrics pass certain critical thresholds.
Maintenance windows
Updates which could impact availability are made outside local business hours as much as possible to avoid disrupting you and your patients.
Responsible disclosure
If you believe you’ve discovered a bug in our security, please email support@physitrack.com and we will get back to you within 24 hours. We request that you not publicly disclose the issue until we have had a chance to address it.
