Healthcare data is sovereign by default.
Veronara's security posture is architectural, not configurable. Identity, encryption, auditability, and residency are properties of the platform, not optional add-ons negotiated at procurement.
Last reviewed:
Identity & access
Encryption
Audit
Data residency
Security headers & network
Monitoring
Incident response
Responsible disclosure
Identity & Access
Role-based access control governs every interaction with HealthOS. Access policies are declarative, auditable, and enforced at the identity layer — not reconciled across integrations. Single sign-on via SAML 2.0 and OIDC. MFA required for administrative roles. Session duration, IP allow-listing, and facility-scoped access enforced per institutional policy.
Encryption
TLS 1.3 for data in transit. AES-256 for data at rest. Dedicated encryption keys per tenant with optional customer-managed keys for regulated deployments. Database-level and field-level encryption for protected health information. Backup encryption inherited from production posture.
Audit
Every action in HealthOS — clinical, administrative, or AI-assisted — is recorded in an immutable audit trail. Audit records include actor, action, target, timestamp, policy reason, and reasoning metadata for AI-surfaced recommendations. Logs retained per regional compliance requirements with configurable archival.
Data Residency
Regional data residency is an architectural property. Deployments run in-region — EU, UK, US, Middle East, APAC, India — with no cross-border data transfer except where explicitly authorized by the institution. Full residency matrix on /trust/residency.
Security Headers & Network
Strict Transport Security with preload. Nonce-based Content Security Policy. X-Frame denial, X-Content-Type nosniff, referrer-policy strict-origin-when-cross-origin, permissions-policy locking camera, microphone, geolocation, and payment APIs. Target grade A+ on securityheaders.com and Mozilla Observatory.
Monitoring
Synthetic monitoring from 8 global regions every 5 minutes. Real-user monitoring for Core Web Vitals and application performance. Error tracking with scrubbed PII. 24/7 on-call with defined severity ladders. Public status page at status.veronara.com.
Incident Response
Material incidents are disclosed publicly within 72 hours on /trust/incidents with root cause, remediation, and data impact. Institutional customers notified directly per contractual SLA.
Responsible Disclosure
Veronara operates a responsible disclosure program. Security researchers may report vulnerabilities to security@veronara.com with PGP-encrypted communication. Acknowledgement within 48 hours. Bug bounty program details published on request to qualified researchers.
Security and procurement review.
Enterprise security questionnaires, penetration test summaries, and security dossiers are available under NDA.
For institutional procurement and security teams.
Acknowledged within two business days.