PHI Protected
No Credit Card Data
No Employee PII
You should not have to rely on what we say about our own security. Anyone can make security claims. Real trust comes from independent verification.
That is why we use Vanta. Vanta is an independent, third-party compliance platform. It is not part of Keona Health.
Vanta continuously monitors our security controls and confirms they stay in effect over time. The controls in our Trust Center are not self-reported or assembled once a year for a review. They are checked by an outside party and updated continuously as evidence is collected.
So instead of a once-a-year snapshot, you see controls confirmed by an outside party and refreshed in near real time. A live controls feed updates throughout the day, reflecting monitoring as it happens.
We maintain both SOC 2 Type I and SOC 2 Type II compliance.
Updated 5 min ago
Protecting patient information takes more than a single policy or an annual audit. It takes safeguards working together every day. Your independently monitored controls span infrastructure, organizational, product, internal, and data-privacy security.
Stays protected through encryption, secure authentication, and restricted access to critical systems and encryption keys. These safeguards sit within Infrastructure Security, with 20+ continuously monitored controls.
Goes beyond technology. Your devices stay protected, sensitive information is handled appropriately, and operational practices stay in effect. This is Organizational Security, with 10+ monitored controls.
Starts with how software is built. Encryption, security testing, and ongoing assessment are built into the product across its lifecycle. This is Product Security, with 5+ monitored controls.
Stay available when you need them most. These services are supported by business continuity planning, disaster recovery readiness, and operational safeguards. This is Internal Security, with 35+ monitored controls.
Is classified, retained, and securely deleted according to documented procedures, including deletion when a customer relationship ends. These are our Data and Privacy controls.
Together, these controls create a layered approach to patient data protection.
CareDesk runs on Microsoft Azure. We work with a short, named list of subprocessors, each with a defined role.
Hosts the CareDesk application and its cloud infrastructure.
Contracts and business documentation.
Provides continuous monitoring and verification of security and compliance controls.
Each provider serves a defined purpose in our operations. Security reviews should be straightforward: you should know where your data is processed and who supports the systems that protect it.
We maintain documented processes for identifying, investigating, and responding to incidents. More detail is available through our Trust Center.
CareDesk runs on Microsoft Azure. Azure's physical security controls and certifications are detailed in our Trust Center resources.
Security is part of the software development lifecycle. More detail is available through our Trust Center.
Contact our security team at security@keonahealth.com.
Security reviews are stronger when the evidence is independently verified. Our Trust Center gives you visibility into independently monitored controls, compliance status, and security documentation for vendor due diligence.
To request our SOC 2 report, email security@keonahealth.com. We will share it under a non-disclosure agreement (NDA).
Access is care. Protecting patient information keeps that access available, reliable, and trustworthy. We combine operational safeguards, technical controls, HIPAA compliance, and independently monitored security controls to help you protect patient information with confidence.
Because when it comes to security, you should not have to take our word for it.
