> For the complete documentation index, see [llms.txt](https://docs.welkinhealth.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.welkinhealth.com/welcome/security-and-compliance.md).
# Security & Compliance
Welkin is built to handle protected health information (PHI) for healthcare organizations, and security and regulatory compliance are core to how the platform is designed, hosted, and operated.
This page summarizes Welkin's current certifications and security practices, sourced from Welkin's Trust Center. For live status, audit reports, and downloadable documentation, see Welkin's [Trust Center](https://security.welkinhealth.com) — it is the source of truth for anything on this page.
### Certifications & Compliance Programs
* **SOC 2 Type 2** — Welkin undergoes an annual SOC 2 Type 2 audit performed by A-LIGN, covering the Security, Availability, and Confidentiality trust services criteria.
* **HIPAA** — Welkin completes an annual self-assessment against the Health Insurance Portability and Accountability Act (HIPAA), the federal law establishing national standards to protect sensitive patient health information from disclosure without the patient's consent or knowledge.
* **GDPR** — Welkin self-assesses compliance with the EU General Data Protection Regulation (2016/679) and other applicable data protection laws.
* **PIPEDA** — Welkin self-assesses compliance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable data protection laws.
### Hosting & Data Residency
Welkin relies on Amazon Web Services (AWS) to provide infrastructure as a service. By default, Welkin operates as a **multi-tenant platform** — customer environments share underlying database infrastructure, logically isolated by tenant, rather than each customer running on its own dedicated database.
* **Default region:** the United States. Data at rest stays within the US by default and is encrypted (AES-256).
* **EU hosting:** available as a standard option for customers that need to keep data within the EU.
* **Other AWS regions:** available on request, for customers with data residency requirements outside the US and EU.
* **Dedicated database:** for customers who require full data isolation, Welkin can provision a dedicated database instance — a separate, isolated cluster for that customer — instead of the standard shared multi-tenant setup.
* **Environments:** every customer gets sandbox, staging, and production environments. Customers choose where real data is used; Welkin recommends never storing production data in non-production environments.
Contact your Welkin Customer Success representative or **** to discuss regional hosting or dedicated database requirements for your organization.
### Data Security & Encryption
* **Encryption at rest:** customer data is encrypted using FIPS 140-2 compliant AES-256, including database backups.
* **Encryption in transit:** data in transit is encrypted with TLS 1.2.
* **Backups:** AWS-enabled automated backups, encrypted at rest. Welkin conducts an annual disaster recovery test to confirm customer data can be restored when needed.
* **Access monitoring:** access to internal systems is reviewed quarterly against the principle of least privilege (PoLP), backed by automated monitoring tools with alerts.
* **Data erasure:** customers can export data via the API or submit a written request for deletion. Off-boarding follows a standardized process, and Welkin sends customers an attestation once deletion is complete.
### Access Control & Authentication
* **Internal access:** granted on predefined roles and the principle of least privilege (PoLP); multi-factor authentication (MFA) is enforced for Welkin team members, along with a minimum password security standard.
* **Customer-facing authentication:** Welkin supports two-factor authentication and single sign-on (SSO) for customer organizations (including Auth0, Okta, OneLogin, Ping Identity, Google, and Azure).
* **Internal logging:** all activity performed by Welkin team members within the platform is logged and monitored.
* **Customer-facing audit trail:** available in the Customer Admin tool — a Data Audit Trail (what patient data was accessed or updated in the Care Portal, by whom, and when) and a Security Log (tracking security access granted or revoked for Welkin Care Portal users).
### Application & Infrastructure Security
* **Software development lifecycle:** cross-functional teams (Product, Engineering, Quality, Technical Support) track all code changes in version control; every change requires review before release.
* **Credential management:** encryption keys are managed using AWS Key Management Service (KMS).
* **Employee security training:** all Welkin team members complete annual mandatory training, including HIPAA compliance, security awareness and fraud prevention, data classification and breach prevention, data privacy and protection, secure software development, and phishing/refresher campaigns.
* **Email protection:** Google and Sophos provide protection against phishing, malicious attachments, and malicious URLs; employees are tested with quarterly phishing simulation campaigns.
* **Endpoint & network security:** disk encryption, DNS filtering, and endpoint detection & response on company endpoints; firewalls, intrusion detection/prevention (IDS/IPS), and data loss prevention on the network.
### Incident Response & Business Continuity
* **Incident response:** Welkin's dedicated security team can respond to incidents 24x7x365. Customers are informed of any security incident that could affect them, in accordance with HITECH/HIPAA and GDPR requirements.
* **Business continuity / disaster recovery:** Recovery Time Objective (RTO) of 4 hours and Recovery Point Objective (RPO) of 15 minutes, validated through annual disaster recovery testing.
* **Independent testing:** an annual third-party penetration test (currently performed by Cobalt Labs Inc.) and an annual internal risk assessment of internal/external threat vectors, based on NIST and OWASP guidance.
* **Status page:** live uptime status is available at [welkinhealth.statuspage.io](https://welkinhealth.statuspage.io/).
### Legal & Contracts
* **Agreements:** Welkin uses a custom Master Services Agreement (MSA) and Statement of Work (SOW) per customer — contact your Customer Success representative for your organization's current agreements.
* **Service-Level Agreement:** Welkin offers standard SLAs with room for individualization to a customer's needs — contact your Customer Success representative to request current SLAs.
* **Cyber insurance:** Welkin carries comprehensive cyber insurance covering attacks or events that cause loss or damage. Contact **** for details.
* **Privacy Policy:** available at [welkinhealth.com/privacy](https://welkinhealth.com/privacy/).
### Reports & Further Information
Detailed documentation — including the SOC 2 report, penetration test report, and network diagram — is available on request through the [Trust Center](https://security.welkinhealth.com). Prospects and customers can request access directly there, or reach out to **** with any security or compliance questions.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.welkinhealth.com/welcome/security-and-compliance.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
