Security you can verify
Our compliance status, security documentation, and the controls behind our program, monitored continuously.
Our security program, independently verified.
Audited against SOC 2, mapped to HIPAA, and monitored continuously, not once a year.
SOC 2 Type 2
CompliantHIPAA
In progressContinuously monitored by Oneleet. Last reviewed November 2, 2026.
Security documents
Reports are shared under NDA. Request access and our team will follow up.
- Penetration testQ3 2025 penetration test reportRequest access
- Audit reportSOC 2 Type 2 audit reportRequest access
- Assurance statementNIST SP 800-171 Security Assurance StatementRequest access
Security controls
The controls behind our compliance program, grouped by domain. Each is mapped to the frameworks it supports.
Access Control and Authorization12 controls
Access granting process used
Implement a formal access granting process that ensures new access privileges are assigned based on the principle of least privilege, and require at least one employee to endorse the granting of new access.
SOC 2HIPAAAccess management policy established
Systematic controls are established in the access management policy for managing user access rights, ensuring appropriate, authorized access to systems and data.
HIPAASOC 2Access requests to sensitive data required
To access sensitive data, employees must submit access requests that are approved and monitored.
HIPAAAccess requests to sensitive infrastructure required
To access sensitive infrastructure components, employees must submit access requests that are approved and monitored. This control helps ensure that only authorized personnel can access critical infrastructure, minimizing potential risks.
HIPAAAccess revoking process enforced
Implement a regular access review process to promptly remove access privileges from employees who no longer require them. This ensures that former employees or users do not retain unauthorized access to organizational resources.
HIPAAAutomatic user logoff enforced
Implement an automatic logoff mechanism to terminate user sessions after a period of inactivity.
HIPAAChanges to PHI logged
Track all changes made to PHI, including additions, modifications, and deletions, to ensure data integrity and enable audit trails.
HIPAAEmergency access procedure established
Establish and maintain a procedure for granting authorized personnel access to critical information during emergencies.
HIPAAMFA required for applications
Require all externally-exposed enterprise or third-party applications to enforce MFA, where supported. Enforcing MFA through a directory service or SSO provider is a satisfactory implementation of this safeguard.
HIPAAPassword management policy enforced
Strictly enforce the organization’s password management policy to guarantee compliance with security standards. Enforcing this policy includes implementing technical controls, monitoring adherence, and responding to non-compliance.
SOC 2Password management policy established
A password management policy is established that mandates strong, complex passwords and prohibits the reuse of previous passwords.
HIPAASOC 2Unique user identification implemented
Enforce the use of unique user identification for all individuals and systems accessing environments where protected information is stored, processed, or transmitted.
HIPAA
Data Management and Protection11 controls
Confidential customer communication channel created
Establish and maintain a secure communication channel for all customer interactions involving protected information.
HIPAACryptographic keys and application secrets secured
Implement and maintain robust procedures to securely manage cryptographic keys and application secrets used for protecting sensitive data throughout their lifecycle. Develop and document a comprehensive key management policy and procedures, including: - Implement secure key generation processes using industry-standard algorithms and random number generators. - Establish secure key storage mechanisms, such as hardware security modules (HSMs) or encrypted key stores. - Enforce strict access controls to limit key/secret access to authorized personnel only. - Implement key rotation and expiration policies to minimize the impact of potential key compromises. - Set up secure key/secret distribution and transmission processes. - Establish and maintain an inventory of all cryptographic keys and their purposes. - Implement secure key/secret backup and recovery procedures. - Ensure proper destruction of retired or compromised keys and secrets. Regularly review and update key management practices to align with current industry standards and best practices.
HIPAAData encrypted at rest
All sensitive data is encrypted when stored on systems or devices.
HIPAASOC 2Data encrypted in-transit
All data is encrypted when transmitted over networks, both within the organization's internal network and external connections.
HIPAASOC 2Data management and retention policy established
A data management and retention policy is established, outlining guidelines for how long data should be retained and how it should be managed throughout its lifecycle.
HIPAASOC 2Data processing integrity and output validated
Define and establish quality control measures to verify the completeness, accuracy, and timeliness of your output. This can look like implementing automated data validation checks, setting up data reconciliation processes, establishing review and approval workflows for critical outputs, creating data quality dashboards for real-time monitoring, and implementing version control systems for data processing scripts. Set up real-time monitoring of these measures and create error logs and incident reports where applicable.
HIPAAExternal privacy inquiries managed
Establish and maintain a system for handling all privacy-related inquiries, including general questions, complaints, disputes, and specific requests for personal information access and correction.
HIPAAPHI access and amendment requests managed
Establish and maintain a documented process to manage individuals' requests for accessing and amending their protected health information (PHI).
HIPAAPHI disclosure records maintained
Establish a system to track disclosures of PHI, ensuring records of disclosures meet HIPAA requirements for accountability and transparency.
HIPAASecure disposal process established
A documented procedure is maintained for the secure disposal of electronic and physical media containing protected, classified, or personal data, rendering it unusable, unreadable, and indecipherable.
HIPAAUse and disclosure of PHI managed
Implement procedures to operationalize the policy defining the permissible uses and disclosures of protected health information (PHI), ensuring compliance with HIPAA requirements in day-to-day activities.
HIPAA
Disaster Recovery7 controls
Automated backups enabled
Automated backups are enabled for all high-risk data and critical systems.
SOC 2HIPAABusiness continuity and disaster recovery policy established
A comprehensive business continuity and disaster recovery policy is established, outlining the organization's strategies for responding to disruptive incidents and supporting business continuity.
SOC 2HIPAAData backup and recovery policy established
Develop and maintain a backup and recovery policy that defines the your approach to protecting and preserving critical data.
HIPAAData recovery process established
Establish a data recovery process that defines procedures for recovering data in case of data loss, corruption, or system failures. A robust data recovery process helps minimize downtime and data loss in critical situations.
HIPAASOC 2Data recovery tested
Regularly test the data recovery process to validate its effectiveness and ensure that data can be successfully restored from backups. Testing helps identify any issues or gaps in the data recovery plan.
HIPAADisaster recovery plans documented
Document disaster recovery (DR) plans to recover critical systems and maintain operational continuity following disruptive incidents. These plans should address potential risks, define recovery strategies, and integrate with broader business resilience efforts.
HIPAARecovery data isolated
Isolate the recovery data from the production environment to prevent accidental overwriting or corruption of backups. Keeping recovery data separate helps maintain the integrity and availability of backup copies.
SOC 2HIPAA
Email Security3 controls
DMARC policy and verification used
DMARC (Domain-based Message Authentication, Reporting, and Conformance) policy and verification mechanisms are implemented to prevent email spoofing and phishing attacks.
SOC 2HIPAAEmail account access restricted
Access to email accounts is restricted to administrators only, and isn't delegated to other non-admin users within the organization.
HIPAASOC 2Email settings block malicious content
Email settings are configured to block malicious content, including malicious attachments, links, and scripts.
SOC 2
Endpoint Security4 controls
Anti-malware deployed on end-user devices
Anti-malware or antivirus solutions are deployed on end-user devices, such as laptops and workstations.
SOC 2HIPAAData encrypted on end-user devices
Data stored on end-user devices (e.g., laptops, mobile devices) is encrypted to protect it in case of device loss or theft.
HIPAASOC 2Firewall maintained on end-user devices
Firewalls are installed and properly maintained on end-user devices, such as laptops and workstations.
SOC 2HIPAAMobile device management (MDM) used
A mobile device management (MDM) solution is used to manage and secure end-user devices.
SOC 2
Infrastructure Security14 controls
Active discovery tools used
An active discovery tool is used to identify assets connected to the enterprise's network, configured to execute daily or more frequently.
SOC 2Administrator access restricted
Restrict administrator access to critical systems and sensitive data based on the principle of least privilege, granting elevated permissions only when necessary for specific tasks and revoking them promptly after completion. Implement strong authentication mechanisms, such as multi-factor authentication, and regularly review and update administrator access rights to ensure they align with job responsibilities and maintain a secure environment.
HIPAAAutomated security scanning performed on infrastructure
Automated security scanning software is deployed on all infrastructure components including servers and network devices.
SOC 2HIPAABuckets not exposed publicly
Cloud storage buckets are not exposed to the public internet unless a documented business justification is in place.
SOC 2HIPAAConfiguration management system established
Implement a configuration management system to manage and control the configuration of systems, applications, and infrastructure. Configuration management helps maintain consistency and security across the IT environment.
SOC 2Firewall restricts public access to infrastructure
Firewalls are configured to restrict public access to the organization's infrastructure components.
SOC 2HIPAAInfrastructure changes logged
Maintain a log of all infrastructure changes to track and document modifications made to critical systems and services. Logging infrastructure changes aids in audit trails, incident investigations, and accountability.
SOC 2HIPAAInfrastructure deployed using an infrastructure-as-code tool
Adopt an infrastructure-as-code (IaC) approach to deploy and manage the organization's infrastructure components. IaC tools enable consistent and version-controlled infrastructure deployment, reducing the risk of configuration errors.
SOC 2Network infrastructure continuously updated
Ensure the network infrastructure components (e.g., routers, switches, firewalls) are continuously updated with the latest security patches and firmware updates. Regular updates help address known vulnerabilities and enhance network security.
HIPAAProduction deployment access restricted
Limit access to production deployment environments to authorized personnel only. This control helps prevent unauthorized changes or deployments that may disrupt critical services.
SOC 2Unauthorized assets addressed and removed
Ensure that a process exists to address unauthorized assets on a periodic basis. This process should include regular audits of all assets and a procedure for handling unauthorized assets when they are discovered.
SOC 2HIPAAUnique production database authentication enforced
Enforce unique authentication mechanisms for accessing production databases, such as a unique username and password or SSH key.
SOC 2VPN used
Utilize Virtual Private Network (VPN) connections to secure remote communications between users and the organization's internal network. VPNs provide encrypted and authenticated tunnels, ensuring secure data transmission over untrusted networks.
HIPAASOC 2Web Application Firewall (WAF) used
Implement a Web Application Firewall (WAF) to protect web applications from various cyber threats, such as SQL injection, cross-site scripting, and other application-layer attacks.
SOC 2HIPAA
Monitoring and Incident Response11 controls
Adequate audit log storage maintained
Ensure sufficient storage capacity to retain audit logs for the required duration. Adequate audit log storage enables historical analysis and supports compliance requirements related to log retention.
HIPAAAudit log management process maintained
Maintain a robust and up-to-date audit log management process. This process should include guidelines for capturing, storing, and monitoring audit logs, ensuring the availability and integrity of essential security event data.
SOC 2Audit logs collected
Audit logs are collected from critical systems and applications, capturing security events for incident detection, investigation, and compliance.
SOC 2HIPAABreach notification process established
A breach notification process is established that outlines procedures for detecting, assessing, and reporting security breaches.
HIPAABreach notification template prepared
A standardized breach notification template is maintained, enabling timely, consistent, and compliant communication with affected individuals in the event of a breach.
HIPAABreach response playbook established
Develop and maintain a breach response playbook focused on managing breaches after they are discovered, including detailed procedures for assessing, containing, and resolving incidents involving protected information.
HIPAAIncident response policy established
An incident response policy is established that outlines the organization's approach and procedures for detecting, responding to, and recovering from cybersecurity incidents.
SOC 2HIPAAIncident response procedures defined
Step-by-step incident response procedures are defined covering detection, containment, eradication, and recovery, with designated team roles and communication protocols for internal and external stakeholders.
HIPAAInfrastructure performance monitored
The performance of the organization's infrastructure components is monitored to detect potential issues or anomalies that may impact security or reliability.
SOC 2Log management used
Implement a centralized log management solution to collect, store, and analyze logs from various systems and applications. Centralized log management simplifies log review, correlation, and monitoring for potential security incidents.
SOC 2Network infrastructure monitored
Implement monitoring mechanisms for the network infrastructure to detect and respond to suspicious or unauthorized activities. Network monitoring helps ensure the integrity and availability of network resources.
SOC 2HIPAA
Organizational Security25 controls
Acceptable use policy established
Establish and maintain an acceptable use policy that outlines permissible activities, systems, and data access for all users, contractors, and third parties interacting with the organization's information assets and technologies.
SOC 2Asset management policy established
Establish an asset management policy that outlines the guidelines for managing the organization's assets throughout their lifecycle.
SOC 2HIPAABoard charter documented
Document the Board charter, which outlines the responsibilities, roles, and authority of the Board of Directors. The charter sets the framework for effective corporate governance and oversight.
SOC 2Board expertise developed
Ensure that the Board of Directors possesses the expertise and skills necessary to provide effective oversight and guidance on various business and industry matters.
SOC 2Board meetings conducted
Conduct regular Board meetings to review organizational performance, strategic direction, and major decisions. Board meetings provide a platform for informed decision-making and governance.
SOC 2Board oversight briefings conducted
Conduct periodic briefings for the Board of Directors to provide updates on cybersecurity and risk management matters. Board oversight briefings enable the Board to stay informed about the organization's security posture.
SOC 2Business associate agreements managed
Establish and maintain a process for managing Business Associate Agreements (BAAs) to meet HIPAA requirements.
HIPAABusiness associate agreements with subcontractors managed
As a business associate, establish a process for managing contracts with subcontractors to ensure they comply with HIPAA requirements. These agreements must extend your obligations under BAAs with covered entities or upstream business associates, including safeguarding PHI, reporting breaches, and adhering to HIPAA standards.
HIPAACode of conduct established
A code of conduct is established that outlines the expected behavior and ethical standards for all employees.
SOC 2Confidentiality Agreement acknowledged by employees
All employees have acknowledged and signed a confidentiality agreement. This agreement reinforces the commitment to safeguarding sensitive information and trade secrets.
SOC 2Employee background checks performed
Conduct thorough background checks on potential employees to verify their identity, employment history, education, and criminal record. Background checks help ensure the suitability and integrity of candidates.
SOC 2External support resources available (i.e., documentation)
Provide external support resources, such as documentation, user guides, and knowledge bases, to assist users in utilizing the organization's services effectively. Accessible support resources promote self-service and reduce support requests.
SOC 2Human resource security policy established
Develop and maintain a human resource policy that addresses information security responsibilities throughout the employment lifecycle, from recruitment to termination.
HIPAAOffboarding process established
An offboarding process is established for departing employees to ensure that they are removed from relevant systems and accounts.
HIPAASOC 2Onboarding process established
An onboarding process is established to ensure new employees are properly granted appropriate access privileges necessary to perform their job responsibilities.
HIPAASOC 2Performance evaluations conducted
Conduct regular performance evaluations for employees to assess their job performance, identify areas for improvement, and recognize exceptional contributions. Performance evaluations support talent development and performance management.
SOC 2Physical access restricted
Physical access to the organization's facilities, equipment, and systems is restricted to authorized personnel only.
SOC 2HIPAAPhysical security policy established
Establish a physical security policy that outlines the organization's processes for protecting physical assets and resources.
HIPAARoles and responsibilities specified
Clearly define roles and responsibilities for all employees within the organization. Specifying roles helps establish accountability and ensures that employees understand their duties and expectations.
SOC 2Security Violations Managed
Establish a security violations management process that outlines the your procedures for detecting, documenting, and addressing security violations by your employees.
HIPAASecurity official assigned
Designate a security official who is responsible for the development, implementation, and oversight of security policies and procedures, as well as management of the incident response process.
HIPAAService description communicated
Clear and detailed service descriptions are communicated to customers or users, outlining the scope, features, and limitations of the services provided.
SOC 2Software development lifecycle established
A well-defined and documented development lifecycle is implemented for software and applications.
SOC 2Whistleblower policy established
Establish a whistleblower policy that allows employees to report any wrongdoing or unethical behavior within the organization anonymously and without fear of retaliation. A whistleblower policy promotes transparency and accountability.
HIPAAWorkstation use and security policy established
Establish a workstation use and security policy that outlines the appropriate use of workstations and security measures to protect them from unauthorized access. The policy helps safeguard the organization's assets and data.
HIPAA
Risk Management3 controls
Risk management policy established
A risk management policy is established that outlines the organization's approach to identifying, assessing, and mitigating information security risks.
SOC 2Vendor inventory maintained
An accurate and up-to-date inventory of all vendors is maintained, including details such as the services provided, contract terms, and the scope of access they have.
SOC 2Vendor management program established
A vendor management policy is established to assess, monitor, and manage the risks associated with third-party vendors, ensuring that external partners meet security and compliance standards.
SOC 2HIPAA
Vulnerability Management4 controls
Penetration testing findings remediated
Vulnerabilities identified during penetration testing are promptly remediated.
SOC 2HIPAAPenetration testing performed within the last 12 months
Penetration testing is conducted at least every 12 months to identify potential vulnerabilities in the organization's systems, applications, and infrastructure.
SOC 2HIPAAVulnerability management policy acknowledged by employees
All employees have acknowledged and agreed to the vulnerability management policy. This policy outlines the procedures for identifying, assessing, and remediating vulnerabilities in the organization's systems and applications.
SOC 2Vulnerability management policy established
A vulnerability management policy is established that outlines the procedures for identifying, assessing, and remediating vulnerabilities in the organization's systems and applications.
HIPAASOC 2
Security reviews, answered.
What security, risk, and procurement teams ask before a review.
Is Replica SOC 2 compliant?
Yes. Replica is SOC 2 Type 2 compliant. The audit report is available on request under NDA.
Is Replica HIPAA compliant?
HIPAA compliance is in progress. The controls mapped to HIPAA are listed above, alongside the ones mapped to SOC 2.
How do I get your penetration test or audit report?
Choose Request access next to the document above. Reports are shared under NDA, and our team follows up on each request.
How are these controls monitored?
The controls are monitored continuously by Oneleet, an independent compliance platform, rather than checked once a year.