Skip to content
Wybit

Compliance

Security Practices

Wybit's security posture is built on transparency, industry best practices, and a defense-in-depth approach. We understand that we process sensitive clinical data, and we treat its security as our primary engineering directive.

Infrastructure security

Our platform is hosted on enterprise-grade cloud infrastructure (AWS/GCP), utilizing isolated Virtual Private Clouds (VPCs). Our database instances are deployed in private subnets with no direct public internet access. We utilize managed services that automatically handle OS-level security patching.

Data security lifecycle

  • Encryption. Data is encrypted at rest using AES-256 and in transit using TLS 1.2+.
  • Backups. Encrypted, automated backups are performed daily and stored redundantly.
  • Retention and deletion. Data is retained only as long as necessary and securely purged upon contract termination or upon request.

Application security

We employ secure software development lifecycle (SDLC) practices:

  • Automated dependency scanning to detect and remediate known vulnerabilities.
  • Static Application Security Testing (SAST) integrated into our CI/CD pipelines.
  • Strict code review processes requiring multiple approvals before deployment.

AI and model security

Our AI agents utilize models that are hosted securely. We do not use public API endpoints that expose your data to consumer model training pools. Prompts and context windows containing PHI are ephemeral and are not used to train baseline foundational models.

Incident response

Wybit maintains a formal Incident Response Plan. We employ automated monitoring and alerting across our infrastructure to detect anomalous behavior. In the event of a security incident, our team is equipped to isolate the threat, mitigate impact, and communicate transparently with affected practices within regulatory timeframes.

Reporting a vulnerability

We welcome collaboration with the security research community. If you believe you have found a security vulnerability in our platform, please report it to security@wybit.io.