Security Policies

At Reperio we take the security of our products and the privacy of our patients’ data very seriously. Due to rapidly evolving technology, we review our security program on a regular basis with consultants and only work with qualified companies who specialize in cyber security. We are HIPAA compliant and our developers have access to our infrastructure on an as-needed basis only. The security program here at Reperio employs industry best practices, including threat modeling, dynamic code testing, regular vulnerability scans, and web/mobile penetration testing.

​

Contents

​

Physical Security

Reperio production data is processed and stored within third-party data centers at Amazon Web Services (AWS), which uses a layered security model with the following safeguards:

• Physical access points to server rooms are recorded by a Closed Circuit Television Camera (CCTV). Images are retained according to legal and compliance requirements.
• Physical access is controlled at building ingress points by professional security staff utilizing surveillance, detection systems, and other electronic means. Authorized staff utilizes multi-factor authentication mechanisms to access data centers. Entrances to server rooms are secured with devices that sound alarms to initiate an incident response if the door is forced or held open.
• Electronic intrusion detection systems are installed within the data layer to monitor, detect, and automatically alert appropriate personnel of security incidents. Ingress and egress points to server rooms are secured with devices that require each individual to provide multi-factor authentication before granting entry or exit. These devices will sound alarms if the door is forced open without authentication or held open. Door alarming devices are also configured to detect instances where an individual exits or enters a data layer without providing multi-factor authentication. Alarms are immediately dispatched to 24/7 AWS Security Operations Centers for immediate logging, analysis, and response.
• Access to data centers is regularly reviewed. Access is automatically revoked when an employee’s record is terminated in Amazon’s HR system. In addition, when an employee or contractor’s access expires in accordance with the approved request duration, his or her access is revoked, even if he or she continues to be an employee of Amazon.
• Physical access to AWS data centers is logged, monitored, and retained. AWS correlates information gained from logical and physical monitoring systems to enhance security on an as-needed basis.
• They monitor their data centers using their global Security Operations Centers, which are responsible for monitoring, triaging, and executing security programs. They provide 24/7 global support by managing and monitoring data center access activities, equipping local teams and other support teams to respond to security incidents by triaging, consulting, analyzing, and dispatching responses.

The AWS infrastructure has been architected to be one of the most flexible and secure cloud computing environments available today. It is designed to provide an extremely scalable, highly reliable platform that enables customers to deploy applications and data quickly and securely.

This infrastructure is built and managed not only according to security best practices and standards but also with the unique needs of the cloud in mind. AWS uses redundant and layered controls, continuous validation and testing, and a substantial amount of automation to ensure that the underlying infrastructure is monitored and protected 24/7. AWS ensures that these controls are replicated in every new data center or service.

​

All AWS customers benefit from a data center and network architecture built to satisfy the requirements of our most security-sensitive customers. This means that you get a resilient infrastructure, designed for high security, without the capital outlay and operational overhead of a traditional data center.

System security

‍

Servers and Networking

Reperio software runs in the Elastic Container Service (ECS) in AWS. We ensure the service remains up-to-date and observe all recommended actions posted in the AWS security bulletins.

Our web servers encrypt data in transit using the strongest grade of HTTPS (TLS 1.2 or higher) so that requests are protected from eavesdroppers and man-in-the-middle attacks. Our TLS certificates are 2048-bit RSA, signed with SHA-256.

​

Storage

Data is stored in an Amazon Relational Database Service (RDS) Postgres instance. All persistent data is encrypted at rest using the AES-128 standards or similarly high standards.

‍

Operational Security

‍

Employee Equipment‍

Employee computers have strong passwords, encrypted disks, and inbound and outbound network traffic monitoring is monitored 24/7.

​Employee Access

We follow the principle of least privilege in how we write software, as well as the level of access employees are instructed to utilize in diagnosing and resolving problems in our software and in response to customer support requests. We review employee access at a regular interval to ensure only those that need access have it.

Code Reviews

All changes to source code destined for production systems are subject to code review by a qualified engineering peer that includes security, performance, and potential-for-abuse analysis.

‍

Application Security

‍

Client and Server Hardening

We have a third-party company that regularly tests our system for vulnerabilities. This company also ensures we are meeting the requirements of the OWASP Top 10.

Request-handling code paths have frequent user re-authorization checks, payload size restrictions, and other request verification/validation techniques. All requests are logged and made searchable to operations staff.

Client code is vetted using several testing methods to ensure that best practices and industry standards are observed and implemented.

We are currently working with our security contractor to become ASVS 1, 2, and 3 certified.

‍

Client and Server Hardening

Reperio is a multi-tenant application that leverages the AWS service, Cognito, for authentication and authorization. We have security measures in place, via code, that prevent any user from accessing another user’s data. Cognito relies upon JWT for authentication. If the JWT is modified in any way the request is rejected preventing someone from impersonating another user. If a user tries to modify the request it will be rejected and the engineering team will be notified. Each session has a timeout specified that requires a user to re-authenticate after a certain number of hours.

‍

Incident Reporting

Reperio monitors for malicious activity such as attempted intrusions, excessive login attempts, and malicious code injection attempts. We are on call 24/7 to respond to security alerts and incidents.

If you have a security concern or are aware of an incident, please send an email to security@reperiohealth.com, a carefully controlled and monitored email account.

‍

HIPAA Security

HIPAA security is of the utmost importance to us at Reperio. We currently contract with two companies, Colington Consulting and Clearwater Compliance. Colington Consulting assists us in our holistic company approach to HIPAA compliance, including employee training and regular HIPAA risk assessments. Clearwater Compliance assures that all of our technical controls meet HIPAA standards. We have regular monthly check-ins regarding security questions and do monthly HIPAA security audits to ensure we remain in compliance.

‍