Magnus Health

Magnus Health hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Security isn't a single yes/no, but Magnus Health is SOC 2 Type II compliant and holds SOC 2 Type II, HIPAA, CCPA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Magnus Health hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@magnushealth.com or via a /security page (Magnus Health lists a security contact).

Magnus Health lists 18 subprocessors on its trust center, including 1Password, Atlassian, Amazon Web Services, DocuSign, Microsoft 365. Buyers use this for fourth-party risk review.

Magnus Health hosts on AWS. Data residency details are on its trust center.

Magnus Health's trust center is at https://trust.magnushealth.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Please see Magnus Health's Controls for details on what we do to protect customer data.

Magnus Health employs advanced monitoring of the dark web using a tool called Recorded Future which automatically scans and collects data from dark web sources. This information is used to identify potential threats, such as leaked credentials or sensitive company information. When compromised credentials are detected, these high priority alerts are automatically routed to our internal IT team who then take the necessary steps to mitigate the risk. With the ability of Recorded Future to proactively detect potential threats, it allows us to take preventative measures like password resets or account lockouts before a bad actor can utilize these credentials in a malicious manner. By staying vigilant and proactive, Magnus Health is actively mitigating the risk of unauthorized access and potential data breaches, ensuring a higher level of security.

Customer data is protected by TLS 1.2+ encryption when in-flight and AES-256 encryption when at rest.

Magnus Health maintains an incident response team (IRT) made up of technical, and management personnel. The incident response plan follows several high-level phases including: - Event assessment - Breach assessment & containment - Reporting - Post-breach activities

Magnus Health utilizes a dedicated Security Operations Center (SOC) to monitor 24x7x365. Additionally, Magnus Health has the following security measures in place: - Web Application Firewalls - Distributed Denial of Service (DDoS) mitigation - File Integrity Monitoring (FIM) - Intrusion Detection System (IDS)

Magnus Health maintains sufficient cybersecurity insurance to protect ourselves and our customers in the event of an incident.

Magnus Health performs security assessment on all third-party vendors before any data is exchanged. This process includes questions surrounding the company's security policies, procedures, controls, and compliance with any applicable industry standards, and focuses on identifying any potential vulnerabilities or gaps.

Magnus Health complies with GDPR, CCPA, and FERPA. Please see Magnus Health's Resource and Compliance section for auditing information and currently available reports.