Compliance Certifications
The Zotec Partners Cloud Platform maintains industry-recognized certifications and compliance attestations to meet the requirements of regulated healthcare environments.
Annual independent audits verify our security controls across five trust service criteria: security, availability, processing integrity, confidentiality, and privacy. Audit reports are available to customers under NDA upon request.
Encryption Standards
All data processed by the platform is protected by strong encryption at every stage of its lifecycle.
| Layer | Standard | Details |
|---|---|---|
| Data at Rest | AES-256 | All stored data encrypted using AES-256-GCM. Encryption keys managed through a dedicated key management service with automatic rotation. |
| Data in Transit | TLS 1.3 | All network communication enforces TLS 1.3. Older TLS versions and cipher suites are disabled. HSTS is enabled on all endpoints. |
| Key Management | FIPS 140-2 | Encryption keys stored in hardware security modules (HSMs) validated to FIPS 140-2 Level 3. |
| API Authentication | OAuth 2.0 / API Keys | All API calls authenticated via OAuth 2.0 bearer tokens or scoped API keys with SHA-256 hashing. |
Infrastructure Security
Our platform runs on US-based, SOC 2 certified data centers with the following protections:
Network Isolation
Each customer tenant operates in a logically isolated virtual private cloud. Network segmentation enforces boundary controls between application tiers.
DDoS Mitigation
Multi-layer DDoS protection with traffic scrubbing at the network edge. Automatic scaling absorbs volumetric attacks without service degradation.
Intrusion Detection
Host-based and network-based intrusion detection systems monitor for anomalous activity. Security events are correlated in a centralized SIEM platform.
Backup and Recovery
Automated daily backups with point-in-time recovery. Backups are encrypted and replicated to a geographically separate facility. Recovery tested quarterly.
Access Control
The platform enforces a defense-in-depth access control model to restrict data access to authorized personnel and systems.
- Role-based access control (RBAC): Granular permissions assigned by role with support for custom role definitions.
- Multi-factor authentication: MFA required for all administrative access. TOTP and hardware security key methods supported.
- Session management: Configurable session timeout and idle lockout policies. Session tokens are bound to client fingerprint.
- Audit logging: All authentication events, data access, and administrative actions are logged with immutable audit trails retained for 12 months.
Incident Response
Our incident response program follows a structured framework aligned with NIST SP 800-61. The program includes defined escalation procedures, severity classification, containment protocols, and post-incident review processes.
In the event of a confirmed security incident involving customer data, we will notify affected customers within 72 hours in accordance with our contractual obligations and applicable breach notification laws.
Vulnerability Management
We conduct regular vulnerability assessments and penetration testing on the platform. Identified vulnerabilities are triaged by severity and remediated according to the following targets:
| Severity | Remediation Target |
|---|---|
| Critical | 24 hours |
| High | 7 days |
| Medium | 30 days |
| Low | 90 days |
Contact Security
To report a security concern or request compliance documentation, contact our security team:
Zotec Partners — Security Operations
Email: security@zotecpartners.cloud
2 Maryland Farms, Suite 210
Brentwood, TN 37027