Compliance documents
What EDFlow publishes, what is shared under NDA (the security review pack, PIA and TRA inputs, penetration test summary, questionnaire answers), the SOC 2 position stated accurately, and how to request documents.
Public
Everything in IT and security: architecture, data flow, PHIPA roles, controls, threat model summary, residency, sub-processors, accessibility, identity, network requirements, service levels, audit logging, AI governance and privileged access.
Under NDA: the security review pack
| Document | Status for a pilot |
|---|---|
| Architecture and data-flow diagrams | Ready |
| Data inventory and classification | Ready |
| PIA input (agent, electronic service provider, voluntary HINP duties) | Draft, completed with your privacy office |
| TRA input, including the AI statement | Draft, completed with your security team |
| Controls narrative mapped to the SOC 2 criteria | Ready |
| Questionnaire master answers (CAIQ v4, SIG Lite); hospital-specific sheets answered from them | Ready |
| Penetration test summary letter | Before live; then annually and after major changes |
| SBOM and dependency policy | Generated in CI |
| Accessibility conformance report (VPAT 2.5 INT) | Ready |
| Incident response and breach notification | Runbook |
| Privileged access and change control | Ready |
| Support schedule, SLOs and DR evidence | Ready |
SOC 2
There is no SOC 2 report yet. A readiness assessment is under way; a Type I report is targeted before live and a Type II after a 6-month observation window. Until then, the pack includes our own control narrative mapped to the SOC 2 criteria, plus the SOC 2 reports of the infrastructure provider that holds live data (AWS). Those are carve-outs: they cover AWS's controls, not ours. Convex Cloud's SOC 2 covers only the sandbox and showcase. No bridge letter is offered, because there is no report period to bridge yet.
Other assurance
- Cyber and technology E&O insurance (carrier and limits in the pack).
- Background checks, annual privacy and security training, confidentiality agreements and quarterly access reviews for staff with privileged access.
Request the pack
Use the contact page on the product site (https://edflow.space/contact) and choose Security review. Tell us your organization and role. We share the pack after an NDA is signed, and we answer your own questionnaire from the master answers.
Related
Dernière mise à jour le
Cette page vous a-t-elle été utile?
Vulnerability disclosure
How to report a security vulnerability in EDFlow: scope, safe-harbour rules, what to include, what never to do with patient data, response times, and security.txt.
Privileged access
How EDFlow vendor staff can and cannot reach production: no standing access, audited time-boxed support access, break-glass with approval and session recording, two-person deployments, personnel security, and data return and destruction.