Security at Vareo
Vareo analyzes remittance and claims data that contains protected health information (PHI). This page summarizes how we protect it. Policies, reports and our current compliance status are available in our Trust Center.
Compliance
- HIPAA: Vareo is a business associate. We sign a Business Associate Agreement (BAA) with every client before any PHI is exchanged.
- SOC 2 Type II: in progress. Our controls are monitored continuously and audited by an independent firm. Status and documentation are in the Trust Center.
Infrastructure and data protection
- Hosted on Amazon Web Services in the United States, under AWS's BAA. Application servers and databases run in private networks, and file storage blocks all public access.
- Data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256 keys managed in AWS KMS.
- Claims files arrive over SFTP with a separate credential for each client, scoped to that client's folder.
- Databases and files are backed up and replicated to a second AWS region for disaster recovery.
- Infrastructure is defined in code, reviewed before every change, and deployed from immutable, scanned container images.
Access control
- Access to production systems and PHI is limited to personnel who need it, granted by least privilege and reviewed quarterly.
- Multi-factor authentication is required on our identity provider, cloud, source code and administrative systems.
- Client users sign in to the Vareo app through our authentication provider, and each organization sees only its own data.
Monitoring and response
- Audit logging of infrastructure activity, threat detection, and alerting on security and availability events.
- Dependency and container vulnerability scanning, with remediation timelines by severity.
- A documented incident response plan, including notification of affected clients as required by HIPAA and our BAAs.
- Live availability of the website, web app and API is published on our status page.
- Vendors are assessed before use and reviewed annually.
Reporting a vulnerability
If you believe you have found a security vulnerability in Vareo, please email security@vareo.ai with a description, the steps to reproduce it, and any proof of concept. We will acknowledge your report within three business days and keep you informed as we investigate.
Please act in good faith: do not access, modify or delete data that is not yours, do not degrade our services, and give us reasonable time to fix the issue before disclosing it publicly.
Contact
Security questions and questionnaires: security@vareo.ai
Product support: support@vareo.ai