Awell Health

Yes. Awell Health's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Awell Health hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Awell Health publishes an ISO certificate on its trust center; you can request access through SOC2C.

Awell Health's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.

Security isn't a single yes/no, but Awell Health is SOC 2 Type II compliant and holds ISO 27001, GDPR, HIPAA, SOC 2 Type II. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Awell Health hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@awellhealth.com or via a /security page (Awell Health lists a security contact).

Awell Health lists 5 subprocessors on its trust center, including Google Cloud Platform, Stytch, Mailgun, Openai, TactionSoft. Buyers use this for fourth-party risk review.

Awell Health hosts on GCP, and handles Customer personally identifiable information, Personal health information. Data residency details are on its trust center.

Awell Health's trust center is at https://security.awellhealth.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Our deployments are fully regional, so your data can be securely hosted either in Europe, UK or the USA via Google Cloud Platform to meet your compliance needs. This means that by design, the data never leaves the region.

Yes! Awell has been SOC2 certified since December '24. We've had no exceptions to any of our controls. Feel free to download our report here in the trust center for your own third party risk assessments! Note that we also only work with reputable vendors and third parties that have ISO27001:2022 and/or SOC2 compliance.

Yes, we're considered as an "important" service provider under NIS2 and applied/subscribed to the relevant authorities to meet the requirements. NIS2 is a EU regulation focusing on standardising a level of cyber security controls in important and essential industries.

Data is encrypted at rest (AES 256) and in transit (HTTPS over TLS1.2+). Our database is deployed on a kubernetes cluster in the Google Kubernetes Engine. It is backed by a kubernetes persistent volume, which is covered by Google Cloud’s Default encryption of data at rest. In cluster db connections use the HTTPS channel and therefore benefit from encryption in transit through TLS. HTTP access to the database is disabled to prevent connections without encryption in transit.

Our product is deployed on Google Kubernetes Engine, and we use regional clusters which already come with built in redundancy (3 zones per region). We have daily backups in all environments, and the provisioning of new environments is fully automated (IaC) so in the worst case scenario where a google data center is fully down we can create a new deployment in a different datacenter and be up and running with the latest backup in a day at most, but realistically it can be as quick as one hour. Our integrations and infrastructure are designed to handle large volumes of patients. Have a look at our system status page for more information.

Yes, the Awell platform is both HIPAA and GDPR compliant via Vanta.

Yes, 100%! We are continuously striving to improve our security posture. While we have our own internal programs, we also have external audits & tests to challenge ourselves and prove our customers we are to be trusted! A quick glance at our testing: 1. Yearly internal ISO27001 audit (performed by an external expert) 2. Yearly external ISO27001:2022 audit 3. Yearly penetration tests 4. Public bug bounty program (responsible disclosure)

We currently offer access to two environments: Sandbox and Production. We have internal-facing environments to support the software development lifecycle. We are able to flexibly support your ongoing integration and testing needs, so please feel free to discuss them with you.

Penetration tests are scheduled every year and performed by an external party.

Our product is deployed on Google Kubernetes Engine, and we use regional clusters which already come with built-in redundancy (3 zones per region). Adding another layer of redundancy (replicate the US deployment to different data centres for example) is on the technical roadmap but not available yet. We have daily backups in all environments, and the provisioning of new environments is fully automated, so in the worst case scenario where a Google data centre is fully down we can create a new deployment in a different datacenter and be up and running with the latest backup in a day max (as defined in our ISMS disaster recovery policy), but realistically it can be as quick as one hour.

Yes! We use Google as our IDP and only allow phishing-proof MFA options. We are using Passkeys are the next-gen alternative for authentication as soon as it's released in our tool ecosystem.

Yes. We annually review all 3rd parties according to our Third-Party Risk Management process, which is audited yearly as part of our ISO-27001 certification. This includes risk assessments, background verification checks, ensuring the right clauses are part of the contract, training and awareness, etc.