Hosting and service providers
VitalSec uses hosted application and data services including Supabase and Vercel for current platform and web operations. PatientLock MDR is delivered through SilverSky when purchased. Other service-specific providers are listed at Subprocessors.
Hosting and deployment arrangements depend on the services in your agreement. Contact PatientLock to review any cloud, location, or deployment requirements for your organization.
Identity and access
VitalSec uses authenticated access and role-based permissions for customer workspaces. Those permissions determine what each user can see and do. Actions performed by Rusty must be supported by the software and authorized by the customer.
Data protection
PatientLock uses encrypted network transport for supported service communications and relies on managed platform encryption and access controls for hosted data. Customer-specific handling requirements, including PHI or regulated personal data, are governed by the applicable MSA, DPA, BAA, Service Order, and system configuration.
Evidence and operational integrity
VitalSec is designed to retain source-linked observations, authorized actions, post-action validation, and evidence records so operational claims can be tied back to what the environment reported. Evidence features do not replace the customer's source systems or independent audit requirements.
Vulnerability management
PatientLock maintains processes for software updates, vulnerability triage, and remediation. Security researchers may use the Vulnerability Disclosure Policy.
Compliance and certifications
Contact PatientLock for documentation supporting a security or compliance review. Any certification, attestation, or authorization attributed to PatientLock must identify its applicable scope and current status.
Certifications held by a hosting or service provider apply to that provider. Framework mapping and readiness services do not establish that PatientLock or a customer holds a certification.
Security contacts
Security questions and vulnerability reports may be sent to security@patientlock.net. Privacy questions may be sent to privacy@patientlock.net.