Security
Security is foundational at Initrel. We implement layered administrative, technical, and physical controls aligned to industry best practices and HIPAA requirements for applicable customers.
Encryption
- Data in transit protected with TLS 1.2+; HSTS enforced on web endpoints.
- Data at rest encrypted with AES-256 or stronger primitives.
- Secrets managed in secure vaulting; key rotation policies in place.
Access Controls
- Role-based access control (RBAC) with least-privilege enforcement.
- MFA required for privileged access; SSO available for enterprise.
- Segregated environments; production access tightly restricted and logged.
Application Security
- Secure SDLC with code review, dependency scanning, and CI security checks.
- Vulnerability management with regular patching and risk-based prioritization.
- API authentication, rate limiting, and input validation to mitigate abuse.
Monitoring & Incident Response
- Centralized logging, anomaly detection, and alerting.
- Documented incident response plan with defined roles and post-incident reviews.
- Customer notification for security incidents as required by law and contract.
Business Continuity
- Backups with periodic restore testing and redundancy across availability zones.
- Disaster recovery plan and RTO/RPO objectives appropriate to service tiers.
- AES-256 at rest, TLS 1.2+ in transit
- Principle of least privilege and role-based access
- Audit logging and alerting
- HIPAA-focused controls with BAA available