DeepSynopsis Security and Compliance
DeepSynopsis takes the protection, confidentiality, and accessibility of our customers' data seriously. We employ proven, industry-standard technologies and practices to guard against unauthorized access, disclosure, alteration, or loss of information, and we continually test and enhance our safeguards to stay ahead of emerging threats.
Regulatory Compliance
We adhere to the U.S. Health Insurance Portability and Accountability Act (HIPAA), including the Privacy, Security, and Breach Notification Rules. Robust administrative, technical, and physical controls are in place to preserve the confidentiality, integrity, and availability of Protected Health Information (PHI). Where applicable, we execute Business Associate Agreements (BAAs) with customers and vendors to ensure shared responsibilities are clearly defined.
Infrastructure Security & Resilience
Microsoft Azure Hosting
DeepSynopsis's production workloads run on Microsoft Azure, a cloud provider recognized for its comprehensive security framework and extensive compliance portfolio (SOC 1/2/3, ISO 27001, HITRUST CSF, and more).
We rely on Azure's built-in security controls, continuous compliance monitoring, and defense-in-depth architecture, as detailed in Microsoft's official documentation:
These resources describe the multilayered safeguards, and the operational practices behind them, that protect the DeepSynopsis Platform and the data entrusted to us.
Azure's multi-layered defense incorporates:
- Data encryption in transit (TLS 1.2+) and at rest (AES-256).
- Built-in threat detection, DDoS protection, and automated security patching.
- Network isolation via virtual networks, private subnets, and granular access controls.
High Availability
Our architecture is designed for fault tolerance and scalability. Redundant services are deployed across multiple Azure availability zones, and automated health checks allow for rapid failover to minimize downtime. DeepSynopsis targets 99.9 percent or better service uptime, with real-time monitoring and on-call engineering support 24 × 7 × 365.
Ongoing Assurance
- Continuous Monitoring – Security events are logged, aggregated, and analyzed using Azure Monitor and SIEM tooling to detect anomalies quickly.
- Vulnerability Management – Routine scans and third-party penetration tests help identify and remediate risks before they impact customers.
- Access Governance – Role-based access control (RBAC), multifactor authentication, and least-privilege principles restrict system access to authorized personnel only.
- Employee Training – All staff complete mandatory security and privacy training on hire and annually thereafter.
By combining Microsoft Azure's secure foundation with our rigorous internal controls, DeepSynopsis delivers a trusted environment that keeps your data safe and your workflows uninterrupted.
Data Security & Privacy
DeepSynopsis is built on a "privacy-by-design" foundation. Every feature— from sign-up to daily use—follows strict controls that protect data confidentiality, integrity, and availability.
User Data
All personal and professional information is processed in accordance with our [Privacy Policy] and [Terms of Use]. Access is restricted through role-based permissions, least-privilege principles, and multifactor authentication.
Protected Health Information (PHI)
If you are a HIPAA-defined Covered Entity and elect to store or transmit PHI through DeepSynopsis, our Business Associate Agreement (BAA) applies. We meet the administrative, physical, and technical safeguards required by the HIPAA Security Rule, ensuring PHI remains confidential, tamper-evident, and accessible only to authorized parties.
Encryption
|
State |
Method |
|
In transit |
TLS 1.2+ with modern cipher suites (AES-256, SHA-256) secures all traffic between clients, APIs, and databases. |
|
At rest |
Microsoft Azure Storage and SQL encrypt data with AES-256. Disk-level and database-level encryption keys are managed by Azure Key Vault and rotated automatically. |
These measures ensure that data is unreadable and unusable to anyone who lacks proper authorization.
Secure Development & Testing
- Static & dynamic code analysis is integrated into our CI/CD pipeline; builds that fail security gates cannot be deployed.
- Continuous vulnerability scanning monitors infrastructure and application layers for emerging threats.
- Annual third-party penetration testing validates our security posture against real-world attack techniques.
Policy Framework
DeepSynopsis maintains a comprehensive set of security policies reviewed at least once per year and updated as needed. Key areas include:
- Asset & Configuration Management
- Data Classification, Protection & Retention
- Secure Software Development Life Cycle (SSDLC)
- Identity & Access Management
- Incident Response & Breach Notification
- Risk & Vendor Management
- Vulnerability Management
All employees complete mandatory security and privacy training on hire and annually thereafter.
Vulnerability Disclosure
We value the security research community and encourage responsible disclosure.
- Report a vulnerability: security@deepsynopsis.com
- Please include clear, reproducible steps or a working proof-of-concept.
- Our security team triages every valid submission, communicates status, and issues fixes as quickly as possible.
- Bounty rewards may be offered at our discretion for verified medium- or higher-severity findings, based on exploitability and potential impact.
By combining Microsoft Azure's hardened platform with rigorous internal controls and transparent disclosure practices, DeepSynopsis delivers a trusted environment for every clinician, researcher, and partner who relies on our platform.