Life Sciences
Clinical DevelopmentRecruit and retain verified participantsReal-World EvidenceConsented data for studies and HEORAccess & SupportFaster onboarding for patient programsProtected like your money. Verified by independent audit.
This page lists AllClear®’s audits, security controls, the data we collect and the third-party services we use.
Controls are monitored continuously with Vanta.
Audits
SOC 2 Type I and II
Controls
12 of 12 in place
Subprocessors
23 listed
Auditor
Prescient Assurance
Audits and reports
AllClear has completed SOC 2 Type I and SOC 2 Type II audits. Customers and partners can request the reports below.
SOC 2 Type I Report
SOC 2 Type II Report
SOC 2 Type II Attestation Letter
Controls
All 12 controls below are in place and monitored continuously.
Control
Status
Infrastructure security
Unique production database authentication enforced. The company requires authentication to production datastores to use authorized secure authentication mechanisms, such as unique SSH key.
In place
Production database access restricted. The company restricts privileged access to databases to authorized users with a business need.
In place
Production network access restricted. The company restricts privileged access to the production network to authorized users with a business need.
In place
Unique network system authentication enforced. The company requires authentication to the production network to use unique usernames and passwords or authorized Secure Socket Shell (SSH) keys.
In place
Remote access encryption enforced. The company’s production systems can only be remotely accessed by authorized employees via an approved encrypted connection.
In place
Intrusion detection system utilized. The company uses an intrusion detection system to provide continuous monitoring of the company’s network and early detection of potential security breaches.
In place
Network firewalls utilized. The company uses firewalls and configures them to prevent unauthorized access.
In place
Product security
Data encryption utilized. The company’s datastores housing sensitive customer data are encrypted at rest.
In place
Internal security procedures
Board charter documented. The company’s board of directors has a documented charter that outlines its oversight responsibilities for internal control.
In place
Data and privacy
Data retention procedures established. The company has formal retention and disposal procedures in place to guide the secure retention and disposal of company and customer data.
In place
Data classification policy established. The company has a data classification policy in place to help ensure that confidential data is properly secured and restricted to authorized personnel.
In place
Data collected
How this information is used and shared is described in our Privacy Policy .
Customer personally identifiable information
Employee personally identifiable information
Subprocessors
AllClear uses the following 23 third-party services to operate.
Subprocessor
Purpose
Amazon Web Services
Cloud provider
Apple Business Manager
MDM for integration with Intune for Apple macOS devices
Atlassian
Issue tracking and data collaboration suite
Bitrise
Mobile application build platform
Bitwarden
Cloud-based enterprise password management
CareMesh
Provider directory search (NPPES)
EtherFax
Cloud service for sending medical record requests via fax to providers on behalf of account holders
Finthrive
Insurance validation for AllClear account holders, to ensure insurance cards are accurate and valid, ensure proper identity and reduce potential fraud
GitHub
Cloud code repository for the AllClear services platform and applications
Google Cloud Platform
Cloud provider
Google Workspace
Google IAM management for access to GCP, suite services
Intelligent Medical Objects
Contracted IMO products: IMO Precision Normalize, IMO Core for Normalize
Lionshare Digital
Website content and hosting
Microsoft Endpoint Manager
IT endpoint management suite
Office 365
Corporate messaging and collaboration
Prescient Assurance
SOC 2 auditing entity
Promon
Mobile App Shield, mobile application endpoint security for AllClear applications
SendGrid
SMTP services
Signicat
Mobile application authentication, identity proofing
Slack
Internal communication and collaboration for development teams, notification feeds integration with GitHub, InsightVM, GCP, Prometheus monitoring and alerting
ThoughtWorks
Software development, IaaS engineering and support, application engineering, customer solutions support
Twilio
SMS messaging
Vanta
Continuous security and compliance monitoring platform
Questions about security?
For security reviews, questionnaires or report requests, contact our security team.