Our Security Commitments
Built with security-first principles. Transparent about our controls today and our roadmap to industry compliance.
Last updated: November 18, 2025
Organizational Security
ReproAlign Technologies is a security-first healthcare AI startup. We operate an Information Security Program aligned to SOC 2 principles and India's Digital Personal Data Protection Act (DPDPA), with a roadmap for US and UAE requirements.
Policies and Training
- Documented security policies reviewed at least annually
- Onboarding security and privacy training for all team members
- Role-based training for engineering and operations
- Confidentiality agreements for all employees and contractors
Risk and Assurance
- Annual risk assessments and continuous control monitoring
- Independent third-party penetration testing (planned annually)
- Vulnerability scanning and secure SDLC practices
- Business continuity and disaster recovery planning
Cloud Security
Our platform is hosted on leading cloud providers with robust physical and infrastructure security. We architect for security by default using least privilege, network segmentation, and encryption.
Data Protection
- Encryption in transit (TLS 1.2+) and at rest (AES-256)
- Secrets management with rotation and scoped access
- Backups with integrity checks and periodic restore tests
- Environment isolation for development, staging, and production
Monitoring and Reliability
- Security logging and alerting for critical events
- Vulnerability management and dependency scanning
- Performance and availability monitoring with SLOs
- Change management and infrastructure as code
Access Security
Access to systems and data follows the principle of least privilege with multi-factor authentication and centralized identity controls.
- SSO and MFA where supported for internal systems
- Role-based access control with quarterly reviews
- Just-in-time access for elevated operations
- Audit logging for administrative actions
Product and Data Security
Secure Development
- Threat modeling and security reviews for sensitive changes
- Static analysis, dependency checks, and CI security gates
- Code reviews with security checklists
- Secure key and credential handling in CI/CD
Data Handling
- Data minimization and purpose limitation
- De-identification/anonymization for R&D where feasible
- Customer data segregation and access logging
- Incident response runbooks and breach notification procedures
Compliance Roadmap
As a growing company, we are actively formalizing controls and engaging assessors to validate our program. Our focus includes jurisdictions where we operate or serve customers.
- DPDPA (India): operational alignment in progress; policy and rights workflows active
- SOC 2 Type I/II: control design complete; audit engagement planned
- HIPAA (US): safeguards mapped for applicable services; BAAs with covered entities as needed
- UAE health data regulations: evaluating hosting and data residency options
Note: Unless expressly stated, certifications are in-progress and not yet awarded.
Incident Response
We maintain escalation procedures for security events, including triage, containment, eradication, recovery, and customer communication where required by law or contract.
- 24x7 monitoring of critical systems and alerts
- Playbooks for common scenarios (credential compromise, vulnerability disclosures)
- Post-incident reviews and corrective action tracking
Contact Our Security Team
Have a security question or found a potential vulnerability? Please contact us. We appreciate responsible disclosure and will work with you to remediate issues.
General Security
Email: security@reproalign.com
Compliance and Privacy
Email: compliance@reproalign.com
Email: privacy@reproalign.com
Changes to This Page
We update this page as our security program evolves and as certifications are achieved. Significant changes will be noted here and in product communications when relevant.