Security

How we protect data

• Each company's data is kept apart, and every request is checked against that separation.
• All traffic uses encrypted connections. Passwords are hashed, and sensitive values such as provider keys and clinical notes are encrypted when stored.
• Two-step verification is available to every account and required for platform administrators.
• Staff can enter a company's workspace only with its approval, for a limited time, and that access is recorded.
• Important changes are recorded in a history the company can review.
• Data is backed up, and backups are kept for 30 days.

Reporting a vulnerability

Write to no-reply@rutbacrm.com with the steps to reproduce the issue. Please give us reasonable time to fix it before making it public, do not access other people's data and do not disrupt the service. We will not take action against anyone who follows these rules in good faith.

Incidents

If a breach affects a company's data, we tell that company without undue delay.