Security
You're trusting us with business and, later, health data. Here's how we plan to protect it, and what we will and won't claim.
Our security plans
These are the controls we're building into NexFlo from day one. We'll update this page as each one is in place.
Encryption in transit
All connections are planned to use TLS 1.2 or higher, including the dashboard, API and SFTP.
Encryption at rest
Stored documents and backups are planned to be encrypted at rest with AES-256.
Access control
Role-based access, multi-factor authentication and least-privilege access for our own team.
Audit logging
A record of who accessed or changed what, available to you in the dashboard.
Data retention
Clear, configurable retention so documents aren't kept longer than you need.
Monitoring
Continuous monitoring for availability and unusual activity.
Built for HIPAA
CareFlo and HealthFlo are being built to meet HIPAA requirements, and we'll sign a Business Associate Agreement (BAA) with every customer who handles protected health information.