Security & Compliance

Last Updated: August 16, 2026  |  Security Review: Quarterly (Next: November 2026)

EverFlow Veterinary Codes™ is committed to maintaining the highest standards of security and compliance to protect our users' data and maintain trust in our platform. This document outlines our security measures, compliance standards, and ongoing commitments.

1. Security Framework

1.1 Information Security Management

Our security program is built following industry-standard frameworks and best practices, including principles from ISO 27001, the NIST Cybersecurity Framework, and OWASP Top 10.

1.2 Security Organization

• Dedicated Chief Information Security Officer (CISO)
• Security Steering Committee with executive oversight
• Regular security training for all employees
• Third-party security assessments and penetration testing
• 24/7 security monitoring and incident response team

2. Technical Security Controls

2.1 Data Encryption

• In Transit: TLS 1.3 encryption for all data transmission
• At Rest: AES-256 encryption for all stored data
• Key Management: Hardware Security Modules (HSMs) for key protection
• Database: Transparent Data Encryption (TDE) enabled

2.2 Access Controls

• Multi-factor authentication (MFA) required for all accounts
• Role-based access control (RBAC) with principle of least privilege
• Single Sign-On (SSO) integration available
• Regular access reviews and deprovisioning procedures
• API key management with rotation and expiration policies

2.3 Network Security

• Next-generation firewalls with intrusion detection
• DDoS protection and traffic filtering
• Network segmentation and micro-segmentation
• VPN access for administrative functions
• Regular vulnerability scanning and penetration testing

2.4 Application Security

• Secure coding practices and code reviews
• Static Application Security Testing (SAST)
• Dynamic Application Security Testing (DAST)
• Software Composition Analysis (SCA) for third-party components
• Regular security updates and patch management

3. Infrastructure Security

3.1 Cloud Security

Our infrastructure is hosted on enterprise-grade cloud platforms with:

• SOC 2, ISO 27001, and FedRAMP certified cloud providers
• Dedicated virtual private clouds (VPCs) with network isolation
• Auto-scaling with security group controls
• Encrypted storage volumes and automated backups
• Geographic data residency controls

3.2 Backup and Disaster Recovery

• Automated daily backups with 30-day retention
• Geographically distributed backup storage
• Regular backup testing and restoration procedures
• Recovery Time Objective (RTO): 4 hours
• Recovery Point Objective (RPO): 1 hour

4. Compliance Standards

5. Veterinary-Specific Compliance

5.1 State Veterinary Privacy Laws

We comply with veterinary confidentiality requirements across all 35 states with specific statutes:

5.2 Academic Partnership Compliance

Our partnership with Virginia Tech VTSL requires adherence to academic research standards:

• IRB approval for research data usage
• De-identification of practice data for research
• Publication review and approval processes
• Data retention policies aligned with research requirements

6. Data Protection and Privacy

6.1 Data Classification

• Public: Marketing materials, documentation
• Internal: Business processes, non-sensitive analytics
• Confidential: Customer data, financial information
• Restricted: Veterinary records, personally identifiable information

6.2 Data Minimization

• Collect only data necessary for service provision
• Regular data purging based on retention policies
• Anonymization and pseudonymization techniques
• Purpose limitation for all data processing activities

6.3 Data Subject Rights

• Right to access personal information
• Right to correct inaccurate information
• Right to delete personal information
• Right to data portability
• Right to opt-out of certain processing

7. Incident Response and Business Continuity

7.1 Security Incident Response

1. Detection: 24/7 monitoring and alerting systems
2. Analysis: Rapid triage and impact assessment
3. Containment: Immediate threat isolation and mitigation
4. Eradication: Root cause analysis and remediation
5. Recovery: Service restoration and validation
6. Lessons Learned: Post-incident review and improvements

7.2 Breach Notification

In the event of a data breach, we commit to:

• Customer notification within 72 hours of discovery
• Regulatory notification as required by applicable laws
• Detailed incident reports and remediation plans
• Credit monitoring services if personal data is compromised

7.3 Business Continuity

• Comprehensive business continuity and disaster recovery plans
• Regular testing of recovery procedures
• Geographic redundancy for critical systems
• Vendor risk management and third-party assessments

8. Third-Party Security

8.1 Vendor Risk Management

All third-party vendors undergo rigorous security assessment:

• Security questionnaires and on-site audits
• Contractual security requirements and SLAs
• Regular security reviews and reassessments
• Vendor performance monitoring and compliance tracking

8.2 Approved Vendors

We maintain a list of pre-approved vendors that meet our security standards for common services like cloud infrastructure, monitoring, and support tools.

9. Security Training and Awareness

9.1 Employee Training

• Mandatory security awareness training for all employees
• Role-specific security training (developers, administrators, etc.)
• Regular phishing simulation exercises
• Annual security policy reviews and updates

9.2 Customer Security Resources

• Security best practices documentation
• Integration security guidelines
• Regular security webinars and updates
• Dedicated security support channel

10. Audit and Monitoring

10.1 Continuous Monitoring

• Security Information and Event Management (SIEM)
• User Entity Behavior Analytics (UEBA)
• File Integrity Monitoring (FIM)
• Database Activity Monitoring (DAM)
• API usage monitoring and anomaly detection

10.2 Regular Assessments

• Annual penetration testing by certified third parties
• Quarterly vulnerability assessments
• Monthly security control reviews
• Continuous automated security scanning

11. Certifications and Attestations

Certification Status

We have not yet engaged third-party auditors for SOC 2 Type II or ISO 27001 certification. As a pre-revenue platform, we've prioritized building our security architecture around these frameworks now, with formal certification planned once we're onboarding paying customers at a scale that warrants the audit investment.

Questions About Our Security Practices

We're happy to walk prospective partners through our current security practices directly, and to complete security questionnaires as part of your vendor evaluation process. Contact our security team for details.

12. Security Contact and Reporting

12.1 Vulnerability Reporting

We encourage responsible disclosure of security vulnerabilities. Please report security issues to:

• Email: security@everflowvet.com
• PGP Key: Available on our security page
• Response Time: Initial response within 24 hours
• Bug Bounty: Rewards for qualifying vulnerabilities

12.2 Security Advisory

Subscribe to our security advisory mailing list for updates on:

• Security patches and updates
• New compliance certifications
• Security best practices
• Threat intelligence relevant to veterinary practices