Security at VComply
VComply maintains the highest standards of security for our customer data. All user data, including personal and compliance-related information, is protected with 256-bit encryption and 2048-bit key agreements in transit and at rest. This provides robust protection against unauthorized access.
SOC 2 Type 2 & HIPAA Compliant
VComply is SOC 2 Type 2 certified, demonstrating our commitment to maintaining strict security, availability, and confidentiality standards. We are also HIPAA compliant, protecting sensitive health information in line with regulatory requirements. These certifications together with our ISO/IEC 27001 compliant status underscore our commitment to maintaining strong internal controls and rigorous security practices.
Enterprise-grade Data Protection
Reliable Data Storage and Backup
With multiple data replication strategies and 24/7 automated backups, VComply ensures your data remains secure and available even during unforeseen events. Our high-availability clusters and secure data centers ensure continuous protection and performance.
Access Control
We limit access to VComply’s production infrastructure to authorized users solely for troubleshooting or support services. User access is enforced through strong passwords, multi-factor authentication, and strict security protocols.
Information Security System
VComply has implemented a comprehensive Information Security Program, effectively communicated across the organization, and adheres to global security and compliance standards, including SOC 2, HIPAA and ISO 27001, ensuring our platform follows industry best practices.
Third-Party Security
VComply ensures that third-party service providers adhere to robust security practices. We regularly conduct independent third-party assessments to evaluate the strength of our security and compliance controls.
Monitoring and Logging
VComply’s monitoring and logging system continuously tracks user activity, data access, and system events, creating detailed audit trails for transparency and accountability. These logs are regularly reviewed and analyzed to ensure the system’s integrity.
Vulnerability Management
Regular vulnerability assessments and testing are conducted to identify and address potential security weaknesses in the system. Patches and updates are applied promptly to mitigate vulnerabilities.
Third-Party Penetration Testing
We conduct an annual third-party penetration test to verify the uncompromised security posture of our services.
Annual Risk Assessments
We conduct risk assessments at a minimum of once a year to detect potential risks, which includes a focus on fraud-related concerns.
Confidentiality
Every team member must sign and comply with an industry-standard confidentiality agreement before commencing their first day of employment.
Quarterly Access Reviews
We conduct access reviews on a quarterly basis for all team members who have access to sensitive systems.
Ensuring Customer Protection
Permissions and Authentication
We utilize Single Sign-on (SSO), two-factor authentication (2FA), and enforce stringent password policies where applicable to safeguard access to cloud services.
Implementing Least Privilege Access Control
We strictly adhere to the principle of least privilege in our identity and access management practices.
Enforcing Password Requirements
Every team member is obliged to meet a predefined set of password criteria and complexity standards to ensure secure access.
Employee Training
All VComply employees receive comprehensive training on security best practices. They are educated on data protection, compliance, and their roles in maintaining the system’s security.
