---
source_url: "https://www.abstractivehealth.com/it-security"
title: "Abstractive Health | IT Security"
mirrored_at: 2026-08-05T15:38:51.139Z
host: www.abstractivehealth.com
cited_in_42a: true
mirror_canonical: "https://index.42a.ai/www.abstractivehealth.com/it-security"
---

> **Original source:** https://www.abstractivehealth.com/it-security

IT Security

## Security and privacy controls built for clinical-grade data.

##### Abstractive Health's Security and Privacy team establishes policies and controls, monitors compliance with those controls, and works with independent auditors to maintain HIPAA and SOC 2 Type II compliance.

If you'd like to review our SOC 2 report, contact us.

![Abstractive Health IT Security](https://www.abstractivehealth.com/images/IT_Abstractive_Health.png)

Policy principles

## Our policy principles

###### We apply a least-privilege philosophy, defense-in-depth controls, and continuous monitoring to protect PHI and customer data.

#### 01

###### Abstractive Health is committed to protecting the security, confidentiality, integrity, availability, and privacy of its information resources.

#### 02

###### Requests for data access are granted only to individuals who meet a least-privilege, minimal-access standard.

#### 03

###### We implement strong, layered security controls according to the principle of defense in depth.

#### 04

###### Controls are applied consistently across systems, monitored continuously, and improved iteratively to increase effectiveness and auditability.

### Ensuring diligent data protection.

#### Encryption at rest

###### Customer data is encrypted at rest using industry-standard encryption and key controls.

#### Encryption in transit

###### Data in transit is encrypted using TLS (including TLS 1.3 where supported).

#### Least-privilege access

###### Access is restricted by role and need-to-know, aligned to minimal access principles.

#### Auditability

###### Logging and monitoring help ensure access, changes, and security events are observable and reviewable.

## Taking product security seriously.

![HIPAA](https://www.abstractivehealth.com/images/logos/hipaa.png)

###### Hosting on AWS's HIPAA compliant cloud for top-tier security and reliability.

![Vanta](https://www.abstractivehealth.com/images/logos/vanta.png)

###### Using Vanta to continuously monitor and scan for vulnerabilities in real-time.

![Penetration testing](https://www.abstractivehealth.com/images/logos/abstractive_small.png)

###### Conducting penetration testing at least once a year through third parties.

### Security is operational, not aspirational.

#### Comprehensive security training

###### The Abstractive Health team undergoes security and HIPAA training upon onboarding and annually thereafter.

#### Safety through interoperability

###### As a Carequality implementer, we share best practices to strengthen security in healthcare technology at scale.

## Security FAQ

Are you HIPAA compliant?

Do you have a SOC 2 Type II report?

How is customer data encrypted?

Who can access patient data at Abstractive Health?

Do you perform penetration testing?

Do you support security questionnaires and vendor risk reviews?

©2026 Abstractive Health. All Rights Reserved.