Security is a core requirement for you and your clients. We have implemented several security mechanisms to keep your personal data and your clients' data safe.
We believe in transparency. The following guide highlights some of the ways Better keeps your data safe and secured.
HIPAA and PIPEDA Compliance
We are fully compliant with HIPAA and PIPEDA regulations:
|Need||Practice Better Approach|
|Encryption||Data is encrypted during transfer and at rest. We also encrypt all backups and log data.|
|Minimum Necessary Access||Access controls are always defaulted to no access unless overrided manually.|
|Physical Security||Our servers are maintained by an SSAE 16 Type II provider which utilizes industry leading security tools, and best practices.|
|Monitoring||All network requests, successful and unsuccessful, are logged.|
|Auditing||All log data is encrypted and unified, enabling secure access to full historical network activity records.|
|Vulnerability Scanning||All customer and internal networks are scanned regularly for vulnerabilities.|
|Backup||All customer data is backed up every 24 hours. Thirty (30) days of rolling backups are retained.|
Contact us if you have specific concerns about regulations outlined by your governing body.
Security in the browser
We do not persist your password in your browser cache. We also use secure cookies with a 30 minute lifespan. You will be asked to re-enter your login credentials if your session is idle for the allotted 30 minute period.
All data sent between your browser and our servers is secured using the industry standard AES-256 bit encryption. In addition, we use an extended validation certificate so you can trust your data is transferred securely.
Data stored on our servers is also encrypted using AES encryption algorithms.
Server & Backups
We store your data on encrypted hard drives on servers in North America.
Data backups are done nightly, so you can rest assured you won't lose sensitive data in the unlikely event of disaster. Backups are stored for 30 days, after which they are completely purged from our system.
We use audit logs to record account changes and communication with your clients. Account changes include updates to your password and changes to your payment information and subscriptions.
We provide you with activity logs when your clients view, sign and complete forms and waivers. The logs include your clients' IP address and location. An IP address uniquely identifies a computer or mobile device on the Internet.