Security-first architecture
Healthcare data demands practical controls, not just checkboxes.
Users & Devices
All access requires verified identity
Edge Security
Traffic inspected before reaching platform
Application Services
Services operate under least privilege
Encrypted Storage
Data encrypted at rest and logically isolated
Security Controls
Continuous verification across infrastructure
Resilience
Designed for rapid recovery
CuraData is built with layered protections so imaging data remains secure across ingestion, storage, and access.
Infrastructure security
Enterprise-grade infrastructure with SOC 2 and ISO 27001 certifications. Automatic patching, vulnerability scanning, and infrastructure-as-code for reproducible deployments.
Global edge network with DDoS mitigation. Web application firewall tuned for healthcare API patterns. Rate limiting and bot detection.
No secrets in code or client bundles. Credentials stored in dedicated vaults with access logging and automatic rotation for service accounts.
Continuous dependency and container image scanning. Security patches applied within SLAs. Annual third-party penetration testing.
Core security controls
TLS 1.3 in transit, AES-256 at rest. Dedicated key management with automatic rotation.
Granular permissions at account, site, and study levels. SSO/SAML support. MFA for privileged accounts.
Every access, modification, and export logged with identity, timestamp, and context. Immutable retention.
Production isolated from dev/staging. Encrypted private networks. Minimized public attack surface.
Data protection
HIPAA Safe Harbor compliant. Burn-in text detection. Configurable DICOM tag scrubbing with audit records.
Choose where data lives. Regional deployments for sovereignty. No cross-border transfers without explicit config.
Configurable policies. Hard deletion for GDPR/CCPA. Logged and verified requests. Backup purging aligned.
Encrypted backups with point-in-time recovery. Regular restore testing. Geo-distributed storage.
Compliance and certifications
Business Associate Agreements available. Technical safeguards implemented per HIPAA Security Rule. Administrative and physical safeguard documentation provided.
Currently undergoing audit. Controls aligned with AICPA Trust Services Criteria. Expected completion Q2 2026. Gap assessment complete.
Data subject rights supported: access, rectification, erasure, portability. Data Processing Agreements available.
Audit trails, electronic signatures, and access controls designed to support Part 11 compliance for regulated research.
Compliance certifications and attestations vary by deployment type. Contact us to discuss your specific regulatory requirements.
Incident response
Automated alerting for suspicious access patterns, failed auth spikes, and unusual data exports. Log aggregation and correlation.
Documented classification, escalation paths, playbooks. Named incident commanders and on-call rotations.
Timelines aligned with HIPAA and state laws. Pre-prepared communication templates. Regulatory reporting documented.
Root cause analysis and lessons learned. Process improvements. Continuous security posture enhancement.
Security by design
Code review required for all changes. Static analysis and dependency scanning in CI/CD. Security-focused design reviews.
Default-deny access. Permissions granted by role requirements, not convenience. Regular access reviews.
Multiple overlapping security layers. No single point of failure. Compensating controls throughout.
Vendor and subprocessor management
Trust and transparency
Security is a continuous process, not a destination. We maintain transparency about our practices and welcome scrutiny.
External oversight for data governance, privacy controls, and ethical considerations.
Formal review for any change touching data handling, with documented rationale and approval chain.
Architecture diagrams, control descriptions, and assessment results available under NDA.
Clear process for security researchers to report vulnerabilities.
Ready to discuss your security requirements?
We work with security and compliance teams at healthcare organizations of all sizes. Whether you need a BAA, SOC 2 report, or custom security assessment, we're ready to help.