Question 1

Is Darthealth SOC 2 compliant?

Accepted Answer

Darthealth is SOC 2 Type II compliant. On SOC2C this listing is Listed.

Question 2

Is Darthealth HIPAA compliant?

Accepted Answer

According to Darthealth's public trust center, Darthealth is HIPAA compliant. On SOC2C this listing is Listed.

Question 3

Is Darthealth SOC 2 Type I or Type II?

Accepted Answer

Darthealth is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Question 4

Can I use Darthealth's SOC 2 for a vendor risk assessment?

Accepted Answer

Yes. Darthealth's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Question 5

Is Darthealth penetration tested?

Accepted Answer

Darthealth hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Question 6

Can I get Darthealth's SOC 2 report?

Accepted Answer

Darthealth's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.

Question 7

Is Darthealth secure?

Accepted Answer

Security isn't a single yes/no, but Darthealth is SOC 2 Type II compliant and holds HIPAA, SOC 2 Type II. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Question 8

Does Darthealth have a bug bounty or vulnerability disclosure program?

Accepted Answer

Darthealth hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@darthealth.com or via a /security page (Darthealth lists a security contact).

Question 9

Who are Darthealth's subprocessors?

Accepted Answer

Darthealth lists 3 subprocessors on its trust center, including Amazon Web Services, GitHub, Vanta. Buyers use this for fourth-party risk review.

Question 10

Where does Darthealth host or store data?

Accepted Answer

Darthealth hosts on AWS, and handles Customer personally identifiable information, Credit card information. Data residency details are on its trust center.

Question 11

Where is Darthealth's trust center or security page?

Accepted Answer

Darthealth's trust center is at https://trust.darthealth.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Question 12

Do you encrypt data at rest?

Accepted Answer

Yes. Data is encrypted by both application persistent storage schemes and file systems to ensure encryption at rest.

Question 13

Do you have a formal process to monitor and deploy application security patches?

Accepted Answer

Yes. Code changes always require a peer review process. Additionally, code repositories are scanned regularly for vulnerability and production applications are monitored for operational health and intrusion. New issues may be reported to support@darthealth.com, and security incidents may be reported to incidents@darthealth.com. Our escalation procedures are described in our SaaS Agreement.

Question 14

Are your AI solutions HIPAA compliant?

Accepted Answer

Yes, our AI solutions are fully HIPAA-compliant. No client data is ever used in AI training data. We sign a Business Associate Agreement, offer privately-hosted and HIPAA-compliant cloud deployments, enforce end-to-end encryption (TLS 1.2+ in transit, AES-256 at rest), and conduct regular risk assessments and penetration tests and offer documentation to support your compliance program.

Darthealth

About

Compliance & infrastructure

Documents

Subprocessors

Compliance leadership

Penetration test

This listing is partial

Frequently asked