Skip to main content

Overview

This document describes the security practices and policies for our software.

Code security​

Static code analysis​

We use Snyk for static code analysis. Snyk does code analysis on a weekly basis and reports any vulnerabilities found in the codebase. We use the Snyk CLI to scan the codebase for vulnerabilities for each pull request and when releasing the latest version of our software.

Monitoring​

Application​

We use sentry for both error monitoring and performance monitoring for both frontend and backend code.

Infrastructure​

Compliance​

CIS​

HIPAA​

Encryption​

Rest​

All data is stored encrypted at rest.

In transit​

All data is encrypted in transit using TLS 1.2 or higher.

Secret Encryption​

We follow best-practices by generating a data key for each secret which is used to encrypt the secret and is itself encrypted with a wrapping key that is stored on AWS KMS by default.