Trust & security

1. Security posture at a glance

• HIPAA Business Associate — a BAA is signed with every practice (available on request).
• PHI encrypted in transit (TLS 1.3) and at rest (AES-256).
• Strict tenant isolation — each practice's data is separated at the database layer with PostgreSQL Row-Level Security, enforced by a constrained database role.
• Multi-factor authentication required for all users; passkeys (WebAuthn) supported.
• Tamper-evident audit trail — append-only, hash-chained, cryptographically signed, and verified daily.
• U.S. hosting on Aptible (AWS-backed), which maintains its own SOC 2 Type II and HITRUST; documents and reports are stored in Amazon S3 (us-east-1) under AWS's BAA.
• Insured — technology errors & omissions and cyber liability at $1M each claim, and general liability at $1M each occurrence, under a shared $3M policy aggregate.

2. Compliance & attestations

HIPAA

Willowcare LLC is a HIPAA Business Associate. We maintain a HIPAA Security Rule program — written security plan, an annual security risk assessment, a designated Security & Privacy Officer, an approved policy suite, an incident-response runbook, and breach-notification procedures — and we sign a BAA with each customer practice that defines our obligations for the PHI we process on their behalf.

SOC 2 — readiness, not certified

We are preparing for a SOC 2 Type I examination covering Security, Availability, and Confidentiality. Where it stands today: the controls are documented — an approved policy suite, a written system description, an executed risk assessment, and a self-assessed gap analysis — and our first disaster-recovery drill is on file. The remaining readiness steps need outside parties: an independent penetration test, and the examination itself. No auditor is engaged yet, so there is no report and no examination date to quote. We will share the report under NDA once one is issued. Until then we describe our actual controls rather than display a badge we have not earned.

willowbridge is a Willowcare LLC product; SOC 2 is being pursued at the company level, with both willowbridge and TenorMD in scope. See the company Trust Center at willowcare.co/trust.

Infrastructure attestations (inherited)

Our hosting provider, Aptible, holds SOC 2 Type II and HITRUST and provides the HIPAA-eligible, U.S.-based infrastructure (compute, managed PostgreSQL, and Redis) that willowbridge runs on. Documents, consent signatures, and reports are kept in encrypted Amazon S3 object storage (us-east-1) under a BAA with Amazon Web Services.

3. Data protection

Encryption

All network traffic uses TLS 1.3 with HSTS. Data at rest is AES-256 encrypted. Particularly sensitive secrets (e.g., authenticator seeds and integration keys) receive an additional layer of authenticated AES-256-GCM encryption with versioned, rotatable keys. Passwords are stored with Argon2id.

Tenant isolation

Every practice ("tenant") is isolated at the database layer using PostgreSQL Row-Level Security. At runtime the application connects through a constrained role that cannot read across tenant boundaries, and an automated check in our build pipeline fails the release if any new data table is missing its isolation policy.

Access control

Access follows least-privilege and need-to-know with role-based permissions. MFA is mandatory; passkeys are supported. Internal access is limited, logged, and reviewed; sensitive document links are short-lived.

Resilience & recovery — tested, not promised

Backups run automatically (point-in-time recovery plus daily, monthly, and yearly snapshots) and are copied to a second region. We treat a backup as unproven until a restore has been demonstrated: our most recent disaster-recovery drill (July 2026) restored a production backup to a fresh database and verified data integrity, tenant isolation, and the audit chain in a measured 15 minutes against a 4-hour recovery-time objective. Drills recur quarterly and each one is filed with its measured results and findings.

Continuous verification

Every release passes static security analysis (SAST), secret scanning, and a dependency-vulnerability gate; a software bill of materials (SBOM) is generated weekly. At runtime, particularly sensitive fields carry their own field-level encryption on top of disk encryption, and an automated monitor watches PHI-access patterns in the audit log and flags anomalies for review.

4. Audit & integrity

Access to PHI and security-relevant actions are recorded in an append-only audit log. Each entry is hash-chained to the previous one and cryptographically signed (Ed25519), so any tampering with history is detectable. The chain is verified automatically every night, and the log is exportable for your own audits and OIG/Joint-Commission defensibility.

5. Secure development

Security is built into our delivery pipeline. On every change we run:

• type checking, linting, and an automated test suite (including tenant-isolation tests);
• dependency vulnerability scanning (gating on high/critical) plus automated dependency updates;
• static application security testing (SAST) and secret scanning;
• a generated Software Bill of Materials (SBOM) for vulnerability response;
• an automated row-level-security coverage check that blocks any tenant table shipping without isolation.

Dynamic scanning (DAST) and an independent third-party penetration test are scoped as the next steps of our SOC 2 Type I readiness; neither has been performed yet. Findings will be tracked to closure.

6. Availability & resilience

Target availability is 99.9% per month (excluding scheduled maintenance), with a recovery-time objective of 4 hours and a recovery-point objective of 1 hour. The database supports point-in-time recovery and object storage is versioned; recovery procedures are documented and tested with restore drills. Operational status is published at status.willowbridge.app.

7. Subprocessors

We use a small set of vetted subprocessors. Each one that may create, receive, maintain, or transmit PHI has an executed BAA with us. The current list:

• Aptible — application hosting: compute, managed PostgreSQL, and Redis (U.S., AWS us-east-1). BAA executed.
• Amazon Web Services — object storage (Amazon S3, us-east-1) for documents, consent signatures, and reports. BAA executed.
• Sentry — application error monitoring; PHI is scrubbed before transmission. BAA executed.
• Tenovi — cellular remote-monitoring devices and delivery of device readings. BAA executed.

Service providers that receive no PHI (listed for transparency):

• SendGrid — staff and operational email; no PHI in message bodies, and there is no patient-directed email.
• Stripe — invoicing and payment of practice fees (no PHI).

athenahealth is not our subprocessor. It is your practice's EHR vendor and our Marketplace partner: willowbridge is available on the athenahealth Marketplace and exchanges data with athenaOne only at your practice's direction.

We give 30 days' advance notice of subprocessor changes, as set out in the BAA.

8. Your data & ownership

Your practice owns its data. You can export patient and billing records at any time (PDF, C-CDA, and structured formats). On termination, we provide a 90-day window to extract data, then securely destroy it and certify the destruction, as defined in the BAA.

9. Reporting a vulnerability

We welcome good-faith security research. If you believe you have found a vulnerability, email [email protected] with details and reproduction steps. Please do not access data that is not yours and give us a reasonable chance to remediate before any disclosure. We acknowledge reports promptly and will keep you updated on the fix.

10. Documentation on request

Under an NDA (and/or an executed BAA), we can share:

• the HIPAA Security Plan and policy-suite summary;
• the current security risk-assessment summary;
• the subprocessor list and SBOM;
• the penetration-test attestation (once available);
• the SOC 2 report (once issued).

11. Contact

• Security — [email protected]
• Privacy — [email protected]
• General — [email protected]