Main content

Security & Compliance

HIPAA-focused safeguards
included from the start

Your clients trust you with their most personal information. GlowScript uses safeguards to help protect that trust. Every layer of the platform — from the infrastructure to the interface — is designed to protect patient data.

HIPAA-focused safeguards
Signed BAA
SOC 2 Infrastructure
US-Only Data Residency

Data Protection

Encrypted at every layer

01Encryption at Rest

All data is encrypted using AES-256 with AWS Key Management Service (KMS). Database storage, file uploads, backups — nothing is stored unencrypted.

02Encryption in Transit

Every connection uses TLS 1.2 or higher. API calls, browser sessions, and internal service communication are all encrypted end-to-end.

03Network Isolation

The database runs inside a private VPC with no public internet access. Only authorized application servers can reach it through private subnets.

04US-Only Data Residency

All data is stored and processed in AWS data centers within the United States. No data ever leaves US jurisdiction.

05Secure Backups

Automated, encrypted database backups with point-in-time recovery. Backup data follows the same encryption and access controls as primary data.

06Secrets Management

All credentials and keys are stored in AWS Secrets Manager with automatic rotation. No secrets are ever hardcoded or stored in source code.

Access Controls

The right people,
the right access

HIPAA requires that only authorized individuals can access protected health information — and only the minimum necessary for their role. GlowScript enforces this at every level.

Multi-Factor Authentication

MFA is enforced for all users, not optional. Time-based one-time passwords (TOTP) via any authenticator app. Recognized devices are remembered so it stays seamless for daily use.

Role-Based Access Control

Granular permissions by role — owners, providers, front desk, and custom roles. Each role sees only what they need. No blanket admin access.

Automatic Session Timeout

Inactive sessions are automatically terminated with a warning before sign-out. Configurable per practice to meet your security policies.

Invite-Only Onboarding

No self-registration. Every user is explicitly invited by a practice administrator, ensuring only authorized personnel have access.

Audit & Monitoring

Complete accountability

Audit Logging & Retention

Audit logging supports security review. Our BAA commits to at least six years of PHI access-log retention. Coverage and retention must be verified for each log category; this commitment does not mean every platform event has been independently verified.

Infrastructure Logging

AWS CloudTrail and VPC flow logs support infrastructure monitoring. Coverage, retention, encryption, and protection against modification depend on the configured log source. Verification of one audit trail does not establish complete application-event coverage or immutability of every log.

Real-Time Monitoring

Configured alerts and security reviews help identify potential issues. Detection and response depend on monitoring coverage and investigation; immediate detection of every incident is not guaranteed.

Breach Notification

In the unlikely event of a security incident, we follow the HIPAA Breach Notification Rule — notifying affected practices within 60 days per 45 CFR §§ 164.400–414.

Disaster Recovery

Recovery requires
verified backups

Backups and documented procedures support business continuity. Restore testing must confirm the available recovery scope and timing. Recovery readiness cannot be inferred from a local exercise alone.

Continuous Database Backups

Database backups are configured for a 35-day point-in-time recovery window. Available restore points depend on backup health. Separately retained backup copies can have different expiration dates; the recovery window is not a promise that every copy expires after 35 days.

Recovery Planning

Infrastructure as code and backups support recovery. Recovery time depends on the incident and validated restore procedures; we do not guarantee a one-hour full-platform restoration.

Versioned File Storage

Versioned storage can help recover eligible previous file versions. Versions are subject to retention, lifecycle expiration, and authorized disposal. A version that has expired or been permanently deleted cannot be recovered through version history.

Deletion Protection

Critical infrastructure — the database, user directory, and encryption keys — has deletion protection enabled, preventing accidental or unauthorized destruction.

Compliance

Business Associate Agreement included

Every GlowScript subscription includes a signed Business Associate Agreement that covers all requirements under 45 CFR § 164.504(e). No separate contract, no legal back-and-forth, no extra fees. Practices that require a custom BAA can work with our legal team directly.

View BAAPrivacy Policy

Infrastructure

Built on AWS

GlowScript runs entirely on Amazon Web Services under a signed AWS Business Associate Addendum. AWS maintains SOC 1, SOC 2, SOC 3, ISO 27001, and HITRUST certifications. Our architecture uses AWS services purpose-built for regulated workloads.

Aurora PostgreSQL

Encrypted database with automated backups

CloudFront + WAF

Edge delivery with web application firewall

Cognito

Identity management with enforced MFA

KMS

Encryption key management and rotation

CloudTrail

API activity logging and audit trail

VPC

Network isolation with private subnets

Questions about security?

We are happy to walk through our security posture in detail, provide additional documentation for your compliance team, or discuss custom requirements for your practice.

security@glowscript.ai