How the system is built.
We assemble proven components rather than writing new ones, and we isolate each practice with infrastructure, not with code.
Architecture
Mail enters through Amazon’s managed mail ingress with authentication and traffic policies. Our policy and encryption layer runs on hardened hosts inside private networks. Outbound mail is sent through Amazon SES with TLS required. Hosted mailboxes run on Amazon’s HIPAA-eligible mailbox service. Archives and audit records are written to object storage with immutability enabled. Everything is in US AWS regions.
Tenant isolation
Each practice has its own mailbox organization, its own encryption key, its own ingress credential and its own policy set. There is no shared database query that could return another practice’s data.
Encryption
- In transit: TLS 1.2 or higher everywhere; TLS required to external recipients with encrypted delivery as fallback.
- At rest: AES-256 through AWS KMS; a dedicated key per practice on Hosted and Pro; keys destroyed on offboarding (crypto-shredding).
- Recipient delivery: one-time code via SMS or email; S/MIME where the recipient publishes a certificate.
Access control
- Customers: MFA required; app passwords scoped and revocable; device policies for phones.
- Staff: single sign-on with hardware security keys; time-limited privileged access with approval; no standing access to message content; all sessions logged.
- Support outside the US: metadata only, never content.
Logging and monitoring
Infrastructure logs, mail events and administrative actions flow into a security data lake with automated threat detection. Logs are scrubbed of PHI by policy and retained for six years in immutable storage.
Backups and disaster recovery
Mailboxes are replicated across availability zones by the platform. Archives and audit records are replicated to a second US region. Our recovery objectives are 4 hours to restore service and 15 minutes of data; we rehearse quarterly.
Vulnerability management
Continuous vulnerability scanning; patches on a defined cadence; independent penetration test before general availability and annually; a public disclosure policy at security.txt.
Secure development
Infrastructure is defined as code, reviewed and scanned before deployment. Changes touching authentication, keys or tenant boundaries require human review.
Insurance
Cyber liability and technology errors & omissions coverage; certificate of insurance available on request.