At EMS SOAP, security is foundational to everything we build. Healthcare data demands the highest level of protection, and we implement comprehensive security controls to safeguard patient information and maintain the trust of our customers.
EMS SOAP has completed an independent SOC 2 Type II examination (Security), with an unqualified opinion and no exceptions noted. We implement HIPAA administrative, physical, and technical safeguards, and provide Business Associate Agreements (BAA) upon request.
All data stored in our database is encrypted using AES-256 encryption. This includes patient information, ePCR narratives, and all associated metadata.
All data transmitted between your browser and our servers is protected using TLS 1.2 or higher. We enforce HTTPS on all connections and implement HTTP Strict Transport Security (HSTS).
We maintain automated daily backups with Point-in-Time Recovery (PITR) capability, enabling restoration to any point within the retention window. Backups are encrypted and stored in geographically separate locations.
Our application is hosted on enterprise-grade cloud infrastructure with DDoS protection, edge network distribution, and automatic SSL certificate management. Our hosting provider maintains SOC 2 Type II certification.
We use a managed PostgreSQL database with Row Level Security (RLS), network isolation, and comprehensive audit logging. Our database provider is SOC 2 Type II certified.
User authentication includes multi-factor authentication (MFA) for platform administrators, secure password policies, and protection against brute force attacks.
Our platform implements granular role-based access controls. Users are assigned roles (Admin, Manager, or Member) that determine their access level to organizational data and features.
Access to systems and data is granted on a need-to-know basis. Employees only have access to the resources necessary for their role, and access is regularly reviewed and revoked when no longer needed.
We maintain formal procedures for provisioning and deprovisioning employee access. Access is granted based on job requirements and removed immediately upon role changes or departure.
We use GitHub Dependabot for automated dependency scanning and receive alerts for known vulnerabilities in our software dependencies. Critical vulnerabilities are prioritized and addressed promptly.
Our APIs are protected by rate limiting to prevent abuse. We implement bot detection, block suspicious traffic patterns, and utilize edge-level DDoS protection.
We maintain a documented incident response program with defined procedures for detection, containment, eradication, and recovery. Security incidents are investigated and documented with lessons learned incorporated into our processes.
EMS SOAP has completed a SOC 2 Type II examination covering the Security trust services criteria, conducted by Advantage Partners for the period March 5, 2026 to June 5, 2026, with an unqualified opinion and no exceptions noted. The report is available on request through our Trust Center, and we use Vanta for continuous monitoring of our security controls.
EMS SOAP is HIPAA compliant. We implement the administrative, physical, and technical safeguards required by the HIPAA Security Rule, and we maintain signed Business Associate Agreements (BAAs) with every subprocessor that handles Protected Health Information. A BAA is available to customers on request. PHI is encrypted in transit and at rest, clinical free-text is de-identified, and access is role-based and audited. Our controls are independently examined under SOC 2 Type II and continuously monitored with Vanta.
We comply with applicable data privacy regulations including GDPR and CCPA. Users have the right to access, correct, and delete their personal data. For privacy inquiries, contact us at brandon@emssoap.com.
For security-related questions or to request our security documentation, please contact us at brandon@emssoap.com.
At EMS SOAP, we take the security of our systems and user data seriously. We value the security research community and welcome responsible disclosure of any vulnerabilities you may find.
If you believe you have found a security vulnerability, please submit it through our HackerOne vulnerability disclosure program, or email us at brandon@emssoap.com.
Please include as much detail as possible to help us understand and reproduce the issue.
Submit a Vulnerability Report on HackerOneWe offer monetary rewards for qualifying vulnerability reports based on severity and impact. Reward amounts are determined on a case-by-case basis, taking into account the potential risk to our users and systems. Critical and high-severity vulnerabilities are eligible for higher rewards.
This is an active public bug bounty program. We appreciate security researchers who help keep our platform secure and reward valid vulnerability reports.