Security is foundational to a platform that handles Protected Health Information. This overview describes the controls in place today; the formal, counsel-reviewed version will govern once finalized.
Encryption in transit and at rest
All traffic to and from the platform is encrypted in transit over HTTPS (TLS). Data is encrypted at rest in the underlying managed Postgres database. Credentials and secrets are never stored in plaintext.
Tenant isolation
Sana Crest is multi-tenant, and isolation between clinics is a core security control. Every data access is scoped to the requesting clinic’s tenant, enforced at the data-access layer so that one clinic can never read or write another clinic’s records.
Access controls and authentication
Access is role-based — owners, administrators, and providers each see only what their role permits. Staff accounts support two-factor authentication, and sensitive administrative actions require an authenticated, authorized session.
Audit logging
Security-relevant actions — access to patient records, prescribing, administrative changes, and license verification — are recorded in an audit log that clinic administrators can review and export. The log is designed to support compliance review and incident investigation.
Business Associate Agreements
Sana Crest signs a BAA with each clinic as the Covered Entity, and maintains BAAs with every sub-processor that may touch Protected Health Information — including our database, email, and error-tracking providers. A copy of the BAA template and security overview is available pre-sale on request.
Infrastructure and sub-processors
The platform runs on established cloud infrastructure with managed, access-controlled databases and backups. We work with a small, vetted set of sub-processors, each selected for its security posture and bound by contract.
Vulnerability management
Dependencies are monitored for known vulnerabilities, and changes pass automated checks before release. We aim to remediate material issues promptly and to keep the platform on supported, patched components.
Responsible disclosure
If you believe you have found a security issue, please email security@sanacrest.com. We welcome good-faith reports and will work with you to confirm and address valid findings.
Questions about this document? Email legal@sanacrest.com.