DRAFT — DO NOT PUBLISH. Certification claims on this page are unverified placeholders. Niral V. Merchant must confirm in writing that BridgeMed Health has achieved the named certifications before this page is published to a production domain. — Veydros Consulting
How BridgeMed Health protects plan member data — at rest, in transit, and across every clinical encounter on every device.
The table below summarises the platform’s technical and operational security controls. It is intended as a quick reference for procurement and IT teams completing a security questionnaire. For underlying control evidence — the actual configurations, screenshots, and audit observations — please request the SOC 2 Type II report.
| Feature | Detail |
|---|---|
| Encryption at rest | AES-256 across all persistent stores, including primary databases, object storage, and backups |
| Encryption in transit | TLS 1.2 / 1.3 enforced on every client connection; legacy protocols disabled at the load balancer |
| Video | End-to-end encrypted video consultations; session keys not retained server-side after the encounter |
| Messaging | Encrypted secure messaging between plan member, clinician, and case manager — not delivered through email |
| File sharing | Encrypted file transfer between plan member, clinician, and case manager — with audit trail for every download |
| Access controls | Role-based access enforced by least-privilege defaults; minimum-necessary principle applied to every record |
| Audit logging | All access and actions are logged and monitored; logs retained for the duration required by PHIPA, PIPEDA, and HIPAA |
| Platform | Native iOS, Android, and browser-based clients; consistent security posture across all surfaces |
Detailed configurations, key-rotation cadences, and control-test observations are documented in the SOC 2 Type II report. Email info@veydros.com to request a copy. [VERIFY WITH NIRAL — DO NOT PUBLISH UNTIL CONFIRMED]
Every encryption claim in the controls table depends on the integrity of the cryptographic keys that back it. BridgeMed Health manages keys through a hardware-backed key management service operated by our cloud provider, with separation of duties between key administrators and the operational engineers who interact with the running system.
Keys are rotated on a documented cadence and on event-driven triggers — for example, on personnel changes affecting privileged access, on detected anomalies, or on the introduction of a new subprocessor. All key operations are logged to a tamper-evident audit trail, and access to the key management console is restricted to a small set of named administrators protected by hardware multi-factor authentication.
Customer-supplied keys are not currently in scope for the platform; all keys are managed by BridgeMed Health under the operational controls described above. This is a deliberate choice to keep the failure surface narrow and the security model auditable. [VERIFY WITH NIRAL — DO NOT PUBLISH UNTIL CONFIRMED]
BridgeMed Health maintains a written incident response procedure covering identification, classification, containment, eradication, recovery, and post-incident review. The procedure is exercised on a regular cadence through tabletop exercises and live drills, and it is updated annually to reflect lessons learned and changes to the regulatory landscape.
For incidents that meet the threshold for breach notification under PHIPA, PIPEDA, or HIPAA, our procedure defines the notification timelines, the named recipients (affected plan members, partner custodians, the IPC, the OPC, and U.S. Health and Human Services as applicable), and the content of the notification. The privacy officer is the accountable owner; the engineering on-call is the operational lead.
Severity levels and target response times are documented internally and tested. Partner organizations may request a redacted incident response summary as part of vendor due diligence. [VERIFY WITH NIRAL — DO NOT PUBLISH UNTIL CONFIRMED]
BridgeMed Health engages an independent third-party security firm to conduct adversarial assessments of the platform on a recurring basis. Scope covers the web application, the iOS and Android clients, the API surface, and the production cloud configuration. Engagements include both unauthenticated and authenticated testing.
Findings are triaged by severity and remediated against documented service-level targets. Critical and high-severity findings are remediated before the engagement is closed, and remediation evidence is reviewed by the testing firm. Medium and low findings are tracked through to closure on a normal product cadence.
Penetration testing schedule and the most recent assessment letter are available to enterprise partners under non-disclosure. [VERIFY WITH NIRAL — DO NOT PUBLISH UNTIL CONFIRMED]
For procurement and IT teams completing a vendor security questionnaire (CAIQ, SIG, or a custom format), BridgeMed Health responds to formal questionnaires within ten business days. Please include the relevant non-disclosure agreement and a named technical point of contact when submitting.
For BAA requests, SOC 2 Type II report requests, or any of the cross-border mappings described on the HIPAA page, the same point of contact applies.
