Security and privacy at ResiOnboarding
This page states what is true of the platform today, so a security reviewer can check it without a call. Where something is not yet in place, we say so.
What we operate today
- All data is encrypted in transit and at rest.
- Row-level security is enforced on every table (83 of 83).
- Every privileged database function pins its execution path.
- Authentication, data access, data modification, permission changes and deletions are audit logged.
- Clinical data is rejected at the ingestion boundary and never stored.
- AI features never receive message content or free-text survey answers.
- Our sub-processor list is published and available on request.
Audit and certification status
SOC 2: not yet audited. Controls are implemented and evidence collection has been underway since September 2026.
HIPAA: the platform is designed to operate without protected health information. HIPAA-mode accounts under a Business Associate Agreement are available on request.
Questions from your security team
We answer security questionnaires directly and can share our control register and sub-processor list. Write to support@resionboarding.com. See also our Privacy Policy, Terms of Service and HIPAA & PHI guidance.