ShipFusion Inc

Yes, we have HIPAA-compliant clients and our role as a 3PL means we fall into the HIPAA Business Associate role. Our approach is that we sign a Business Associate agreement that commits us to ensuring we respect your compliance requirements, and our internal compliance controls (visible in this trust center) are designed to cover the requirements of HIPAA Business Associates, together with various other data privacy frameworks, such as those included in SOC2, GDPR and Californian CCPA.

Personally-Identifiable Information (PII) is clearly identified in our data policies and their storage is limited across the system. In summary, we have little use for your customer PII beyond generating the necessary shipping labels and documents, hence our retention and systems that handle PII are limited and tightly controlled. We also have regular audits from Ecommerce partners like Amazon, who require stringent adherence to their Customer PII data policies for us to maintain integrations with them, irrespective of our clients' requirements. We also operate in states like California and ship to European destinations, so all PII data has to also comply with CCPA and GDPR frameworks. Customer PII also can be from HIPAA-compliant clients, so we treat this data equally across our systems to for simplicity and security. We are pursuing 3rd party certifications such as SOC2 and using platforms like Vanta that power this trust site to provide external confidence and verification that we are adhering to these statements.

We use Wiz.io (https://www.wiz.io/), the industry-leading cybersecurity platform, to continuously scan logs, configuration of our server and hosting infrastructure, and code of our software. This provides us with real-time alerts on suspicious behaviour across our entire environment, such as a potential security breaches or any misconfigurations that may lead to a weakened security posture. We also have other monitoring tools such as Datadog that allows us to detect real-time changes where breaches might not be easily discoverable, such as unusual network behavior, external bad hosts attempting to request URLs or server utilizations that are abnormal. We run malware scanners that also report any detected malware or unexpected applications across both our server environment and corporate IT hardware. All of this is centralized into alerts and investigated as they are suspected.

Our datacenter presence is all located within Amazon AWS data centers in the United States. No data is processed or stored in other countries or territories, and all data is encrypted in transit to and from our services, and at rest inside our services

We first started with CIS Critical Security Controls v8, as we felt that this provided a software-orientated security-first foundation for our policy framework. We also noted that there would be a fair amount of overlap with SOC2 controls, giving us an efficiency of satisfying a higher-level of software security with a standardized audit certification that is easily recognized. Once we have obtained our SOC2 Type II certificate, we'll be exploring further enhancements from the CIS control suite, ISO 27001 specification and recommendations from our 3rd parties and partners.