HiBoop Trust Centre - Security, Privacy & Compliance

The HiBoop Trust Centre explains how we protect your data and your clients' data. HiBoop is SOC 2 Type II certified and complies with HIPAA (BAA available), PIPEDA, and GDPR. We understand that the security of client data is central to your clinical practice.

Our platform uses AES-256 encryption for data at rest and TLS 1.3 for data in transit. We conduct regular third-party security audits and maintain a detailed compliance program to ensure the integrity and confidentiality of protected health information (PHI). By using Google Cloud Platform's secure infrastructure, we provide a secure and reliable environment for digital measurement-based care. Our security framework is designed to meet the rigorous demands of hospitals, large health systems, and private practices alike.

Your Clients' Data,
Protected by Design

Security isn't a feature, it's the foundation of clinical safety. We build upon international healthcare standards to honour your clients' trust.
Trusted by healthcare organizations across North America

Security & Compliance

Security First / Privacy by Design

  • What HiBoop is certified for, the privacy laws it complies with, and how to get the evidence for your security review.

  • SOC 2 Type II

    Certified

    HiBoop is SOC 2 Type II certified: an independent audit of how our security controls operate over time, not on a single day.

    Report date: September 2026

    Request the SOC 2 report

  • HIPAA

    Compliant

    HiBoop complies with HIPAA, and Business Associate Agreements (BAAs) are available.

  • PIPEDA

    Compliant

    HiBoop complies with PIPEDA, Canada's federal privacy law, and is built to support provincial privacy laws.

  • GDPR

    Compliant

    Support for data-subject rights, including access, erasure, and portability.

  • PCI DSS v4.0

    Compliant

    HiBoop complies with PCI DSS v4.0. Card payments are processed by Stripe.

Defense-in-Depth

  • Multi-layered security strategy protecting every data vector. Hardened at the infrastructure, application, and clinical levels.

  • Encryption Everywhere

    AES-256 at rest and TLS 1.3 in transit with automated key rotation.

  • Network Isolation

    Compute instances run in private VPCs, isolated from the public internet.

  • Vulnerability Management

    Daily scanner cycles and annual 3rd-party penetration testing.

Application Integrity

User Controls & Access

  • Security features designed for clinical precision. Protection without friction.

  • Audit Logging

    Immutable Trails

    Every view and export is cryptographically logged. Complete visibility into data access.

    TIMESTAMPACTIONHASH
    2026-01-31VIEW_PHI0x7f…a9
  • Multi-Factor Auth

    Enforced Multi-Factor

    Standard across all clinical accounts. Support for TOTP and hardware security keys.

  • Role-Based Access

    Granular Controls

    Strict Role-Based Access. Personnel only see PHI relevant to their clinical authorization.

  • Session Management

    Smart Timeouts

    Configurable idle timeouts automatically protect data on shared clinical workstations.

  • Endpoint Security

    Employee Device Security

    DrSprinto scans all employee computers for active malware protection and compliance standards.

Data Residency & Subprocessors

Transparency & Partners

  • Every vendor undergoes a security review. Customer data stays in Google Cloud regions in its home country: Canada or the US, with other regions on request.

    • DPA Verified
    • BAA Executed
    • Data Never Sold

  • Google Cloud

    Infrastructure

    Application hosting & database

    CA / USPHI Sync

  • Cloudflare

    Security

    WAF, DNS & DDoS protection

    GlobalNo PHI

  • Sprinto

    Compliance

    Compliance automation

    USNo PHI

  • Stripe

    Payments

    Card payments

    USNo PHI

  • HubSpot

    CRM

    Relationship management

    USNo PHI

Data Standards

Open Standards / Interoperability

  • HiBoop keeps scored results in a structured, exportable form, so your data is always yours to take with you.

  • EHR integrations on request

    Works alongside your EHR

    HiBoop does not replace your EHR. Scored results export for your clinical documentation, and when your organization needs results inside its EHR, we scope that integration with you on request.

  • Data Portability

    Works with your existing stack

    Export scored assessment and outcome data in standard, structured formats you can use in your own systems.

  • Open Export

    Your data, your formats

    Full data export, included in every plan. You own your data, always. No lock-in, no ransom exports, no proprietary formats.

System Status

System Health

  • Checking…

    Status

    Checking…

    API Gateway
    ...
    Global CDN
    ...
    Cloudflare
    WAF & DDoS
    ...
  • Uptime
    Last 90 Days
    99.0%
    Checked every 15 minutes since Oct 22, 2026As of Oct 30, 2026

    654 of 660 external checks passed (home page, sitemap, consent geo and form endpoint). Days with a failed check: 2.

Responsible Disclosure

Security Research

  • We welcome the contribution of security researchers. If you identify a vulnerability, report it promptly to our protocol response team.

    Contact Security RFC 9116 / security.txt

  • In Scope

    • Auth/Authorization bypass
    • Injection vulnerabilities (SQL, XSS, SSRF)
    • PHI or patient data exposure
    • Broken access controls / IDOR
    • Session management flaws
    • Audit log bypass or tampering
    • Encryption weaknesses (data at rest / in transit)

  • Out of Scope

    • Social Engineering / Phishing
    • DDoS / volumetric attacks
    • Scanner-generated reports without a verified finding
    • Testing against HiBoop staff or employees personally
    • Destructive testing (deleting, modifying, or exfiltrating production data

Need a Security Review?

Frequently Asked Questions

  • Is HiBoop HIPAA compliant?

    Yes. HiBoop adheres to the HIPAA Privacy and Breach Notification Rules, and Business Associate Agreements (BAAs) are available. Our platform implements technical safeguards including encryption, access controls, and audit logging to protect Protected Health Information (PHI).

  • Does HiBoop comply with Canadian privacy laws?

    Yes. HiBoop complies with PIPEDA (Personal Information Protection and Electronic Documents Act) and is built to support provincial privacy laws. Customer data stays in Google Cloud regions in its home country: Canada or the US, with other regions on request.

  • What security certifications does HiBoop have?

    HiBoop is SOC 2 Type II certified. It is HIPAA compliant (BAA available), PIPEDA compliant, and supports GDPR data-subject rights. We run annual third-party penetration testing and daily vulnerability scanning to maintain our security posture.

  • Is HiBoop GDPR ready for international clients?

    Yes. HiBoop supports GDPR Privacy by Design principles with full support for subject rights including data access, erasure, and portability. Our platform architecture enables compliance with EU data protection requirements for international deployments.