Security

How Revyola protects your data and maintains platform integrity.

SOC 2 Type IIHIPAA CompliantSOC 2 Type II

🔐

Encryption

✓Data at rest: AES-256 encryption via Supabase

✓Data in transit: TLS 1.3 for all connections

✓Database credentials: stored as encrypted environment variables

✓API keys: rotated quarterly, never logged

🛡

Access Control

✓Role-based access control (RBAC) for all platform features

✓Multi-factor authentication available for all accounts

✓Session tokens expire after 30 days of inactivity

✓All access events are logged with timestamp and IP address

🤖

AI & PHI Protection

✓PHI scrubber strips 18 HIPAA identifiers before AI processing

✓AI models receive only de-identified, synthetic claim data

✓No patient data is used to train or fine-tune AI models

✓All AI API calls are encrypted and not retained by the provider

🏗

Infrastructure

✓Hosted on Vercel (SOC 2 Type II, ISO 27001)

✓Database on Supabase (SOC 2 Type II, HIPAA eligible)

✓Automatic backups every 24 hours with 30-day retention

✓99.9% uptime SLA on infrastructure providers

🔍

Monitoring & Incident Response

✓24/7 automated security monitoring

✓Anomaly detection on API usage and data access patterns

✓Security incidents escalated within 1 hour

✓Breach notification within 60 days as required by HITECH

✅

Compliance

✓HIPAA/HITECH compliant with BAA available

✓SOC 2 Type II certification in progress

✓Penetration testing conducted annually

✓Vulnerability disclosure: info@revyola.com

Report a Vulnerability

If you discover a security vulnerability, please report it responsibly to info@revyola.com. We investigate all reports within 48 hours and provide updates throughout resolution.

Questions about this document?