Information Security

Keeping patient and practitioner secure is of paramount importance to Physitrack. Our extensive information security management system (ISMS) and security controls, as well as careful selection of the subcontractors, third parties and subprocessors that we work with play a key part in protecting practitioner and patient data.

Below, find a high-level summary of some of the security controls which we have in place. Because our philosophy is to continually improve, these controls are reviewed and - where possible - improved annually.

Physitrack is registered with the United Kingdom Information Commissioner's Office under number ZA396165.

Controls that protect confidentiality

  • Privacy-first

    We ask and store as little as possible and have designed our platform and operations in line with the EU's strict GDPR principles. Non-EU subprocessors have Standard Contractual Clauses in place.

  • Data encryption in transit and at rest

    All data sent to and from our platform is encrypted in-transit and encrypted at rest. See our SSL Labs score.

    For Physitrack Telehealth, all traffic between clients and Dolby® is encrypted. All media between the client and server use standard protocols (DTLS/SRTP) encrypted with 128 bit AES.

    TLS encryption is used for inbound and outbound email.

  • HIPAA compliant

    On top of all the controls that protect the confidentiality, integrity and availability of PHI, we have BAAs in place with third parties and subcontractors who have access to PHI.

  • Confidentiality & our team

    Access to patient data is severely restricted, and any person or party that (potentially) has access to patient data is bound by confidentiality agreements.

  • Local storage in countries/regions

    Physitrack runs physically isolated platforms in different data centers around the world to avoid leaking data outside jurisdictions as much as reasonably possible.

  • Security audits

    Every year, we hire an accredited third party to perform grey box penetration tests on our platform. This includes testing for vulnerabilities against OWASP-threats.
    Every week, an independent third party scans our platform for known vulnerabilities.
    Any uncovered vulnerability is prioritised, resolved and deployed as soon as possible following discovery.

  • ISO 27001 & ISO 27018 certification

    ISO 27001 (formally known as ISO/IEC 27001:2013) is a standard for Information Security Management Systems (ISMS).

    An ISMS is a framework of policies and procedures that includes all legal, physical and technical controls involved in an organisation's information risk management processes with the aim of keeping information secure.

    Data is hosted and processed inside AWS. AWS holds SOC and ISO 27001 certification.
    Physitrack, our development team and SRE team each hold their own, independent ISO 27001a certification.

    Download the Physitrack ISO 27018 Certificate

    Download the Physitrack ISO 27001 Certificate

  • Network security

    Our network security architecture consists of multiple security zones.
    We monitor and protect our network, to make sure no unauthorised access is performed using:
    - a virtual private cloud (VPC);
    - a bastion host or VPN with network access control lists (ACL’s) and no public IP addresses;
    - a firewall that monitors and controls incoming and outgoing network traffic;
    - IP address filtering.

  • Physical security

    Our infrastructure is hosted inside AWS. Physical and environmental security related controls for our servers, which includes buildings, locks or keys used on doors, are managed by AWS:
    “Physical access is strictly controlled both at the perimeter and at building ingress points by professional security staff. Authorised staff must pass two-factor authentication a minimum of two times to access data center floors."

  • No payment information stored

    We don't store bank or credit card information on our servers and use PCI-DSS certified third parties (Adyen and Chargebee) to process payments.

Controls that protect integrity

  • Secure Development Lifecycle

    We use industry-best practice development processes both for our applications and our infrastructure.
    Code is under version control (Git), and features/fixes are developed in separate branches.
    Before being reviewed by a peer, code has to pass thousands of automated tests and is scanned for known security issues. The fix/feature is then manually tested (QA) and merged to the master code branch.
    We have separate testing, staging and production environments.

Controls that protect availability

  • High-availability databases

    Our data is processed on AWS RDS databases (Postgresql) and replicated in a high-availability configuration.

  • Daily backups

    Every day, our databases are backed up and stored encrypted. Backups are verified regularly.

  • 24/7 monitoring

    Our virtual NOC monitors our infrastructure 24/7/365 and both our SRE team and our entire development team are alerted if infrastructure metrics pass certain critical thresholds.

  • Maintenance windows

    Updates which could impact availability are made outside local business hours as much as possible to avoid disrupting you and your patients.

Responsible disclosure

If you believe you’ve discovered a bug in our security, please email and we will get back to you within 24 hours. We request that you not publicly disclose the issue until we have had a chance to address it.