Security & Compliance
Security controls for healthcare revenue cycle management: encryption in transit, field-level encryption of designated PHI at rest, tenant isolation enforced in the database, role-based access control and audit logging - designed to support your HIPAA obligations. These pages also say which safeguards are not yet in place. No SOC 2 report is held, and no audit has been engaged yet.
Security Features
Built for HIPAA obligations
Technical safeguards designed to support HIPAA Security Rule obligations - field encryption, access control, tenant isolation, audit logging - and a BAA template. Several administrative safeguards are not yet in place.
SOC 2: not held
No SOC 2 report is held, and no audit has been engaged yet. The controls that do exist are documented on these pages so you can assess them directly.
Field-level encryption
Designated PHI fields encrypted with AES-256-GCM; TLS 1.2+ in transit. The database volume and backups are not encrypted.
Audit trails
Sign-in, administrative and payment events are logged, and every opening of a patient record is logged and reviewable by administrators
Documentation
HIPAA Safeguards
15 minWhich HIPAA safeguards ArkCloud implements, which it does not yet, and what stays with your organisation
Data Encryption
10 minField-level encryption at rest, TLS in transit, and what is not encrypted
Access Controls
12 minThe five roles, server-side permission checks, tenant isolation and operator access
Multi-Factor Authentication
8 minAuthenticator-app MFA: who must enrol and how
Single Sign-On
15 minGoogle sign-in; Microsoft Entra ID is built but not switched on; SAML is not available
Session Management
10 minSession lifetime, lockout and revocation as they actually work
Audit Logging
12 minThe three audit logs, what each records and its limits
Data Retention
10 minRetention periods, archival status and backups
Incident Response
15 minHow to report a security incident, and the state of the response procedure
Vulnerability Management
10 minWhat is scanned, when, and how to report a vulnerability
Penetration Testing
8 minNo penetration test has been performed yet; what a customer can do
SOC 2 Status
12 minNo SOC 2 report is held and no audit has been engaged yet; what a SOC 2 audit would involve
Business Associate Agreement
10 minThe BAA template and what to check before signing
Security Best Practices
15 minRecommended security practices for healthcare organizations
Assess the controls yourself
The safeguards ArkCloud implements, and the ones it does not yet, are documented on these pages so you can assess them yourself. No SOC 2 report is held, and no audit has been engaged yet.