Security

Your health data deserves a vault. So we built one.

Security is not an add-on at Soro, it is how we operate. Six locks stand between your medical records and the outside world. Scroll through each one.

Follow your data

Read our privacy policy What we never do

Lock 01 · HIPAA & BAAs

Signed before your records are stored

Your records are stored in Amazon Web Services under a signed HIPAA Business Associate Agreement, which binds AWS to protect them the way the law binds us.

How we use and protect your information is spelled out in our privacy policy.

Handshake HIPAA review BAA signed Access opens

Lock 02 · Encryption

Encrypted in transit and at rest

Data moves over TLS and rests under AES-256, backups included. There is no unencrypted path in and no unencrypted copy inside.

Plain data TLS handshake AES-256 cipher Encrypted at rest

Lock 03 · Secure intake

One door in, straight to storage

Billing files upload through an encrypted channel that lands them directly in secured storage. They are never emailed and never handled as loose files.

File upload Encrypted channel Secured storage Verified landing

Lock 04 · Access controls

Least privilege, fully logged

People see only what their work requires, behind individual authenticated logins. Every access to health data is logged: who, what, when. Everybody who can touch PHI is certified to handle it.

Authenticated login Certified staff Scoped access Logged read

Lock 05 · Infrastructure

An isolated home on HIPAA-eligible cloud

Your records are stored on HIPAA-eligible cloud infrastructure, inside an isolated network environment. Our policy keeps them off laptops, phones and portable drives.

HIPAA-eligible cloud Isolated network Secured storage Monitored boundary

Lock 06 · Monitoring

Watched continuously

Logging and monitoring run continuously, and unusual access is flagged to our security team as it happens.

Continuous scan Anomaly flagged Human review Resolved

The short version

Security by the numbers

0 bit AES encryption On every stored byte, backups included

0 sign-in factors to open a patient's file A fresh sign-in plus an authenticator code

0 automated logging Unusual access is flagged as it happens

0 way in for your documents: an encrypted upload Bills are never taken by email

Follow one file

What happens to your bill at Soro

From the moment it leaves your system to the moment someone reads it, a file is never unprotected and never unaccounted for.

Upload

The file leaves your system through an encrypted link. Nothing travels by email.

In transit

TLS wraps it the whole way. No readable copy exists en route.

At rest

It lands in secured storage and rests under AES-256, isolated from the open internet.

On the record

Every open and every read is logged with a name and a time. Nothing happens quietly.

The rules we run on

Always and never

Four promises we keep, four lines we do not cross.

We always

Encrypt every byte, in transit and at rest
Scope access to exactly what the job requires
Log every access to your health data
Ask for a second sign-in before anyone opens your file

We never

Email your bills or records around as loose attachments
Let anyone touch your health data without it being logged
Sell your information
Put advertising or social media trackers on this site

Questions

Ask us directly

If you want to know exactly how your records are handled, ask. Reach us through the contact page and you will get a direct answer from a person.

Ask us Read our privacy policy