ShiftPretty is building administrative, technical and physical safeguards around the sensitivity of care-related information. Our Phase 1 environments use sample/non-PHI data. PHI is enabled only in an approved Phase 2 environment after the customer BAA, subprocessor agreements, security review and onboarding controls are complete.

Our security approach

Identity and access. Access is designed around unique identities, role-based permissions, least privilege, customer administration and additional controls for privileged access. Publish exact MFA coverage only after enforcement evidence is approved.

Data protection. ShiftPretty encrypts information using protocols and storage controls documented in the customer security schedule. Publish AES/TLS versions only after databases, object storage, backups, logs, integrations and internal traffic are verified.

Accountability. Supported workflows record relevant user and administrative activity. Publish exact event coverage, retention and export claims only after product verification.

Secure development and vulnerability management. ShiftPretty’s program includes code/dependency review, vulnerability handling and controlled release practices appropriate to the service. Publish testing frequency or third-party assessment claims only after completion.

Resilience and response. Backups, restoration, monitoring, incident response and customer notification are governed by tested procedures and applicable contracts. Uptime, RTO and RPO appear only in an approved SLA/security schedule.

Subprocessors. Phase 2 PHI subprocessors must sign appropriate BAAs before receiving ePHI. A current subprocessor list and customer change process will be available through the trust workflow.

Shared responsibility

Customers are responsible for authorized users, role assignment, devices, lawful configuration, workforce training, professional decisions and promptly reporting suspected compromise. ShiftPretty is responsible for the safeguards and contractual duties assigned to it for the approved service.

Report a concern

Send suspected vulnerabilities to security@shiftpretty.com. Do not access, alter or retain another person’s data; disrupt service; use social engineering; or test outside the authorized scope. ShiftPretty will acknowledge valid reports according to the published vulnerability-disclosure process. Do not publish safe-harbor language until counsel approves and the response queue is staffed.

Customer assurance

Eligible customers may request the security overview, subprocessor list, DPA, approved BAA, service documentation and completed assessment materials available for their service scope. Contact /contact?topic=security.