How we handle access, patient data, and your systems.
These are the practices we follow today. If your security review needs more detail, we will answer your security questionnaire.
Access and credentials
- Every engineer uses a named account with multi-factor authentication for code, cloud, and client systems.
- Production access is granted per client, with least privilege, and approved by the client.
- Access is removed within 24 hours when someone leaves a project or the company.
- Secrets live in a secrets manager, never in code or chat.
Patient data (PHI)
- No PHI in development or testing. We use synthetic or de-identified data.
- No PHI on laptops. Company devices are managed and fully encrypted.
- Production access and changes are logged, and you can review the logs.
- Everyone completes HIPAA training before touching client systems.
- Our US company signs business associate agreements when our work involves PHI.
Where our people work, and the US-only option
Cyber Labs Solutions is a US company. Our US-based staff are employees and US citizens. Most of our engineers are contractors in Armenia whose hours cover the US night; they work under written agreements with the US company.
HIPAA does not prohibit offshore access, but some contracts, programs, and state laws do. Tell us about those obligations before we scope the work. For clients that require it, only US-based employees who are US citizens access PHI and production systems, and engineers in Armenia work only on code, infrastructure, and de-identified data.
Your code, your accounts, your data
- We work in your cloud and code accounts, so you can see and revoke our access at any time.
- You own the code, repositories, and data. At the end of an engagement we hand over credentials and documentation.
Backups and disaster recovery
Backups are automated, and restores are tested on a schedule, because a backup that has never been restored is not a backup.
Incident response
We follow a written incident response procedure with named roles and client notification timelines. On-call runs on a named rotation, and response times by severity are written into each operations agreement.
AI tools
We use AI coding tools under approved terms. No PHI or client secrets are sent to them.
What we do not have yet
We do not hold SOC 2, HITRUST, or other third-party certifications today. We say so up front, and if your contract requires a subcontractor to hold one, we will tell you we are not the right fit rather than waste your time.
Trust FAQ
Do you have SOC 2 or HITRUST?
Not today. For most work we operate inside your environment under your controls, and we answer your security questionnaire with the practices on this page.
Can engineers outside the US access our patient data?
Only when your contracts and applicable laws allow it, with the controls on this page. For clients that require it, only US-based employees who are US citizens access PHI and production systems.
Who owns the code and data?
You do. We work in your repositories and cloud accounts and hand over credentials and documentation at the end of an engagement.