Security & compliance
How Vestibo protects your customers.
A HIPAA tier in development and a SOC 2 program in progress. Your data is encrypted in transit and at rest today.
Encrypted in transit and at rest · HIPAA tier in developmentWhat we commit to
Six commitments, plain English.
Each commitment maps to a control in our SOC 2 readiness program. The audit is not complete, so no SOC 2 report exists yet.
Encryption at rest
Passwords and access tokens for the tools you connect are encrypted by the app itself with AES encryption, using keys kept outside the app. Transcripts, audit logs, and backups are stored in our database, which AWS encrypts at rest. Keys can be rotated on demand.
Encryption in transit
Every connection to Vestibo is encrypted with TLS 1.2 or newer. Unsecured web addresses redirect to the secure one, and browsers are told to always use it.
Managed encryption keys
The keys that protect stored data are managed in AWS Key Management Service, where automatic rotation is available. On request, we can show you which key is in use.
Business Associate Agreement
We sign BAAs only on the Clinic tier, which is not offered or purchasable today. No e-signature provider is engaged yet, so no BAA can be signed right now.
Health information redaction
Part of the HIPAA tier in development: protected health information is removed from knowledge content as it is added, by a fixed, one-way process. Removal is permanent. The original is not kept and cannot be recovered.
Sub-processor list
The authoritative list is published at vestibo.com/legal/subprocessors. We give 30 days' notice before adding a sub-processor. Email privacy@vestibo.com to follow changes.
Run it yourself
Live encryption check
It tests the encryption behind your account — stored data, connections, and the keys that protect them — and records each run in your audit log. It comes with the HIPAA tier, for signed-in account owners.
The HIPAA tier is still in development, so the check is not available yet.