# Security at Soro > How Soro protects your medical bills and health records: encryption in transit and at rest, least-privilege access, signed agreements with every vendor, and continuous monitoring on HIPAA-eligible infrastructure. Security ## Your health data deserves a vault. So we built one. Security is not an add-on at Soro, it is how we operate. Six locks stand between your medical records and the outside world. Scroll through each one. [Follow your data](https://www.soro.health/security#baa) [Read our privacy policy](https://www.soro.health/privacy) [What we never do](https://www.soro.health/security#vows) Lock 01 · HIPAA & BAAs ### Every hand signs first Soro operates under signed HIPAA Business Associate Agreements with every vendor that touches health data. Nobody in our supply chain sees your records without being legally bound the same way we are. How we use and protect your information is spelled out in our [privacy policy](https://www.soro.health/privacy). _Handshake_ _HIPAA review_ _BAA signed_ _Access opens_ Lock 02 · Encryption ### Encrypted in transit and at rest Data moves over TLS and rests under AES-256, backups included. There is no unencrypted path in and no unencrypted copy inside. _Plain data_ _TLS handshake_ _AES-256 cipher_ _Encrypted at rest_ Lock 03 · Secure intake ### One door in, straight to storage Billing files upload through an encrypted channel that lands them directly in secured storage. They are never emailed and never handled as loose files. _File upload_ _Encrypted channel_ _Secured storage_ _Verified landing_ Lock 04 · Access controls ### Least privilege, fully logged People see only what their work requires, behind individual authenticated logins. Every access to health data is logged: who, what, when. Everybody who can touch PHI is certified to handle it. _Authenticated login_ _Certified staff_ _Scoped access_ _Logged read_ Lock 05 · Infrastructure ### An isolated home on HIPAA-eligible cloud Your records live on HIPAA-eligible cloud infrastructure, inside an isolated network environment. Nothing sits on a laptop, a phone, or a thumb drive. _HIPAA-eligible cloud_ _Isolated network_ _No local copies_ _Monitored boundary_ Lock 06 · Monitoring ### Watched around the clock Logging and monitoring run continuously. Unusual access gets flagged and reviewed the moment it appears, not discovered later. _Continuous scan_ _Anomaly flagged_ _Human review_ _Resolved_ The short version ### Security by the numbers **256** bit AES encryption On every stored byte, backups included **100%** of vendors that touch health data under signed BAAs Before any health data moves **24/7** logging and monitoring No off hours, no blind spots **0** files outside secured storage Never emailed, never loose Follow one file ### What happens to your bill at Soro From the moment it leaves your system to the moment someone reads it, a file is never unprotected and never unaccounted for. #### Upload The file leaves your system through an encrypted link. Nothing travels by email. #### In transit TLS wraps it the whole way. No readable copy exists en route. #### At rest It lands in secured storage and rests under AES-256, isolated from the open internet. #### On the record Every open and every read is logged with a name and a time. Nothing happens quietly. The rules we run on ### Always and never Four promises we keep, four lines we do not cross. #### We always - Sign the agreement before any data moves - Encrypt every byte, in transit and at rest - Scope access to exactly what the job requires - Watch the logs around the clock #### We never - Email your bills or records around as loose attachments - Store your records on laptops or portable media - Give a vendor access before a HIPAA agreement is signed - Let anyone touch your health data without it being logged Questions ### Ask us directly If you want to know exactly how your records are handled, ask. Reach us through the contact page and you will get a direct answer from a person. [Ask us](https://www.soro.health/contact) [Read our privacy policy](https://www.soro.health/privacy) --- This is the Markdown representation of , which also serves it under `Accept: text/markdown`. Site overview for agents: .