Your Trust. Our Commitment.
At Athelas, we understand that trust is earned through transparency, reliability, and integrity.
Our platform powers healthcare innovation while maintaining the highest standards of security, privacy, and compliance. Athelas connects care teams, patients, and technology securely — every interaction, every time, because patient data protection isn’t optional.
Security
We take a defense-in-depth approach to security at every layer of our infrastructure.
Data Protection
- Encryption at rest: AES-256 encryption for all stored data
- Encryption in transit: TLS 1.2+ with perfect forward secrecy
- Key management: Hardware security modules (HSMs) and automated key rotation
Access & Identity
- Multi-factor authentication (MFA): Required for all user accounts
- Role-based access control (RBAC): Principle of least privilege across all systems
- Single sign-on (SSO): Enterprise identity provider integration (Okta, Azure AD, Google Workspace)
- Session management: Automatic timeout and device fingerprinting
Infrastructure Security
- Intrusion detection: 24/7 automated monitoring with real-time alerting
- DDoS protection: Multi-layer mitigation at edge and application layers
- Data residency: US-based infrastructure in HIPAA-compliant data centers
Experience Innovation Firsthand
- Vulnerability management: Automated scans and frequent patch cycles
- Penetration testing: Annual third-party security assessments
Compliance
Commure, Athelas’s parent company, adheres to industry-leading frameworks for healthcare data protection.
SOC 2 Type II
Audited by an independent third party (in progress / certified).
HIPAA Compliance
Audited by an independent third party (in progress / certified).
GDPR & CCPA
We support international privacy regulations for data subjects’ rights.
Privacy
We treat patient and customer data with the respect and protection it deserves.
Our Privacy Principles
- No data selling: We never sell, rent, or share Protected Health Information (PHI) or customer data
- Purpose limitation: Data is only processed to deliver, improve, and support our products
- Data ownership: Customers retain full ownership and control of their data
- Transparency: Clear documentation of data practices and processing activities
Data Rights
- Access: Request copies of your data at any time
- Portability: Export data in standard formats (FHIR, CSV, JSON)
- Deletion: Request deletion of data subject to legal retention requirements
- Correction: Update or correct inaccurate information
Our Privacy Principles
- Minimal collection: We collect only data necessary for service delivery
- Retention limits: Data retained according to documented schedules and customer contracts
- Subprocessor oversight: All vendors undergo security and privacy reviews
- Cross-border transfers: Standard Contractual Clauses (SCCs) for international data flows
Reliability & Uptime
Our commitment to reliability ensures healthcare operations run smoothly.
99.9%
Uptime Target
Real-Time Status
Incident Transparency
All incidents and resolutions are publicly tracked via an Incident.io integration.
Disaster Recovery
Tested quarterly with full backup and recovery plans.
Subprocessors
Commure partners only with vetted subprocessors who meet our security and compliance standards. Each subprocessor undergoes annual security and privacy reviews.
Request a List of Subprocessors
Contact Us
Have questions about our security or compliance program? Our Security and Privacy teams are here to help.