Your Trust.
Our Commitment.
At Athelas, we understand that trust is earned through transparency, reliability, and integrity.
Our platform powers healthcare innovation while maintaining the highest standards of security, privacy, and compliance. Athelas connects care teams, patients, and technology securely — every interaction, every time, because patient data protection isn’t optional.
Security
We take a defense-in-depth approach to security at every layer of our infrastructure.
Data Protection
Encryption at rest: AES-256 encryption for all stored data
- Encryption in transit: TLS 1.2+ with perfect forward secrecy
- Key management: Hardware security modules (HSMs) and automated key rotation
Access & Identity
Multi-factor authentication (MFA): Required for all user accounts
- Role-based access control (RBAC): Principle of least privilege across all systems
- Single sign-on (SSO): Enterprise identity provider integration (Okta, Azure AD, Google Workspace)
- Session management: Automatic timeout and device fingerprinting
Infrastructure Security
Intrusion detection: 24/7 automated monitoring with real-time alerting
- DDoS protection: Multi-layer mitigation at edge and application layers
- Data residency: US-based infrastructure in HIPAA-compliant data centers
Experience Innovation Firsthand
Vulnerability management: Automated scans and frequent patch cycles
- Penetration testing: Annual third-party security assessments
Compliance
Commure, Athelas’s parent company, adheres to industry-leading frameworks for healthcare data protection.
SOC 2 Type II
Audited by an independent third party (in progress / certified).
HIPAA Compliance
Audited by an independent third party (in progress / certified).
GDPR & CCPA
We support international privacy regulations for data subjects’ rights.
Privacy
We treat patient and customer data with the respect and protection it deserves.
Our Privacy Principles
No data selling: We never sell, rent, or share Protected Health Information (PHI) or customer data
Purpose limitation: Data is only processed to deliver, improve, and support our products
Data ownership: Customers retain full ownership and control of their data
Transparency: Clear documentation of data practices and processing activities
Data Rights
Access: Request copies of your data at any time
Portability: Export data in standard formats (FHIR, CSV, JSON)
Deletion: Request deletion of data subject to legal retention requirements
Correction: Update or correct inaccurate information
Our Privacy Principles
Minimal collection: We collect only data necessary for service delivery
Retention limits: Data retained according to documented schedules and customer contracts
Subprocessor oversight: All vendors undergo security and privacy reviews
Cross-border transfers: Standard Contractual Clauses (SCCs) for international data flows
Reliability & Uptime
Our commitment to reliability ensures healthcare operations run smoothly.
99.9%
Uptime Target
Real-Time Status
Incident Transparency
All incidents and resolutions are publicly tracked via an Incident.io integration.
Disaster Recovery
Tested quarterly with full backup and recovery plans.
Subprocessors
Commure partners only with vetted subprocessors who meet our security and compliance standards. Each subprocessor undergoes annual security and privacy reviews.
Contact Us
Have questions about our security or compliance program? Our Security and Privacy teams are here to help.