Question 1

Is Scope Health SOC 2 compliant?

Accepted Answer

Scope Health is SOC 2 Type II compliant. On SOC2C this listing is Listed.

Question 2

Is Scope Health SOC 2 Type I or Type II?

Accepted Answer

Scope Health is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Question 3

Can I use Scope Health's SOC 2 for a vendor risk assessment?

Accepted Answer

Yes. Scope Health's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Question 4

Is Scope Health penetration tested?

Accepted Answer

Yes — Scope Health undergoes third-party penetration testing as part of its security program. The pentest vendor is listed on its SOC2C profile.

Question 5

Can I get Scope Health's SOC 2 report?

Accepted Answer

Scope Health's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.

Question 6

Does Scope Health have a penetration test report?

Accepted Answer

Scope Health publishes a penetration test summary on its trust center. You can request access to it through SOC2C.

Question 7

Is Scope Health secure?

Accepted Answer

Security isn't a single yes/no, but Scope Health is SOC 2 Type II compliant, and undergoes third-party penetration testing. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Question 8

Does Scope Health have a bug bounty or vulnerability disclosure program?

Accepted Answer

Scope Health hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@tavahealth.com or via a /security page (Scope Health lists a security contact).

Question 9

Who are Scope Health's subprocessors?

Accepted Answer

Scope Health lists 1 subprocessor on its trust center, including AWS. Buyers use this for fourth-party risk review.

Question 10

Where does Scope Health host or store data?

Accepted Answer

Scope Health hosts on AWS, and handles Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.

Question 11

Where is Scope Health's trust center or security page?

Accepted Answer

Scope Health's trust center is at https://security.tavahealth.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Question 12

Want to report a potential security issue?

Accepted Answer

Please report any security issues to security@tavahealth.com

Question 13

Do you support Single Sign-On (SSO)?

Accepted Answer

In order to preserve the privacy of clients who use the Tava benefit through their organization, we do not provide SSO. However, we do provide secure authentication mechanisms that endure rigorous penetration testing and regular evaluation.

Question 14

How do you monitor for security breaches?

Accepted Answer

Tava has established numerous systems in our cloud environment to monitor for security breaches. In addition, we perform regular penetration testing to test the security of our systems and our monitoring systems.

Question 15

Where are your servers located?

Accepted Answer

All customer data is processed on servers in the United States

Scope Health

About

Compliance & infrastructure

Documents

Subprocessors

Compliance leadership

Penetration test

This listing is partial

Frequently asked

Healthcare peers that completed SOC 2

Vitablehealth

Elfie

ThoughtFull World

Ambiencehealthcare