Question 1

Is Powerfulmedical SOC 2 compliant?

Accepted Answer

Powerfulmedical is SOC 2 Type II compliant. On SOC2C this listing is Listed.

Question 2

Is Powerfulmedical ISO 27001 certified?

Accepted Answer

According to Powerfulmedical's public trust center, Powerfulmedical is ISO 27001 certified. On SOC2C this listing is Listed.

Question 3

Is Powerfulmedical HIPAA compliant?

Accepted Answer

According to Powerfulmedical's public trust center, Powerfulmedical is HIPAA compliant. On SOC2C this listing is Listed.

Question 4

Is Powerfulmedical GDPR compliant?

Accepted Answer

According to Powerfulmedical's public trust center, Powerfulmedical is GDPR compliant. On SOC2C this listing is Listed.

Question 5

Is Powerfulmedical SOC 2 Type I or Type II?

Accepted Answer

Powerfulmedical is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Question 6

Can I use Powerfulmedical's SOC 2 for a vendor risk assessment?

Accepted Answer

Yes. Powerfulmedical's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Question 7

Is Powerfulmedical penetration tested?

Accepted Answer

Powerfulmedical hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Question 8

Is Powerfulmedical secure?

Accepted Answer

Security isn't a single yes/no, but Powerfulmedical is SOC 2 Type II compliant and holds ISO 27001, SOC 2 Type II, HIPAA, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Question 9

Does Powerfulmedical have a bug bounty or vulnerability disclosure program?

Accepted Answer

Powerfulmedical hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@powerfulmedical.com or via a /security page (Powerfulmedical lists a security contact).

Question 10

Who are Powerfulmedical's subprocessors?

Accepted Answer

Powerfulmedical lists 5 subprocessors on its trust center, including Amazon Web Services, Zendesk, FusionAuth (Inversoft LLC), Sentry, Snowflake. Buyers use this for fourth-party risk review.

Question 11

Where does Powerfulmedical host or store data?

Accepted Answer

Powerfulmedical hosts on AWS, and handles Customer personally identifiable information, Personal health information. Data residency details are on its trust center.

Question 12

Where is Powerfulmedical's trust center or security page?

Accepted Answer

Powerfulmedical's trust center is at https://trust.powerfulmedical.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Question 13

Does Powerful Medical maintain a risk management program?

Accepted Answer

Powerful Medical has a risk management program and performs annual company-wide risk assessments, conducted by the Powerful Medical security team. Our security team manages and tracks the lifecycle of these risks as they are mitigated and treated.

Question 14

What data does Powerful Medical process?

Accepted Answer

The data shared with Powerful Medical varies based on the provided product and its implementation. Given the nature of our products, it is possible that we will process and store PII and PHI within the ECG data gathered through different sources. This may encompass, among other details, essential patient demographic data such as Patient Name, Date of Birth, and any additional information supplied to PMcardio. For details on our handling of customer PII and PHI, please consult the PMcardio privacy policy.

Question 15

Where are your servers located?

Accepted Answer

PMcardio customers who are on the Enterprise Plan have the option to host their data in our US or EU data centers. With ownership over your hosting region, you can ensure we meet your data security goals. PMcardio supports Data Residency through our Amazon Web Services-operated data centers in Ireland (Europe Region) and the United States.

Question 16

Is all data encrypted in transit and at rest?

Accepted Answer

All data sent to and from Powerful Medical is encrypted. Our API and application endpoints are TLS/SSL-only to ensure secure communication with our clients and partners. All data at rest is encrypted using AES-256.

Question 17

Is PMcardio and its risk management system compliant with the EU AI Act?

Accepted Answer

Our risk management system is systematically organized and regularly maintained to ensure continuous compliance with Article 9 of the AI Act. Specifically, our overarching Information Security Management System risk management practices are fully aligned with internationally recognized standards, including ISO 27001 and SOC 2, which address information security and operational controls comprehensively. Importantly, all AI-specific and product/medical device-related risks are identified, evaluated, controlled, and monitored rigorously in accordance with ISO 14971, the internationally recognized gold standard for risk management in medical devices. Importantly, our medical device AI modules are certified against the requirements of the EU Medical Device Regulation (2017/745) which superseed the AI Act requirement for medical devices. This integrated approach ensures that our products maintain the highest standards of safety, security, and regulatory compliance.

Powerfulmedical

About

Compliance & infrastructure

Subprocessors

Compliance leadership

Penetration test

Recent updates

This listing is partial

Frequently asked