Security at EonPro
EonPro runs the clinical, pharmacy and billing operations of telehealth clinics, which means we hold protected health information on their behalf. This page describes how we protect it. It is written for clinic operators, their compliance teams, and security reviewers.
Last updated September 4, 2026
How we protect patient data
Encryption everywhere
All traffic is served over TLS 1.2+ with HSTS. Databases, backups and document storage are encrypted at rest with AES-256 using AWS KMS. Sensitive patient fields (name, date of birth, phone, email, address) are additionally encrypted at the application layer before they reach the database.
Tenant isolation
Every clinic operates in its own logical tenant. Each record carries a clinic identifier that is enforced by our data-access layer, which fails closed whenever tenant context is missing, so a request cannot read or write another clinic’s data.
Strong authentication
Multi-factor authentication (authenticator app with backup codes) is challenged at every sign-in for enrolled users and is mandatory for administrator and provider accounts, with a short enrollment grace period for newly created accounts. Sessions are short-lived and bound to the originating clinic. Patient portal access uses one-time codes delivered to a verified email or phone.
Least-privilege access
Role-based access control is enforced on every API route. Production infrastructure is administered by a small number of named identities with MFA; no shared credentials, and no standing access for automation — our CI pipeline receives a short-lived, IP-scoped grant that is revoked seconds later.
Audit logging
Every access to, modification of, or export of protected health information is recorded with the acting user, timestamp, source IP, and action. Infrastructure changes are recorded by AWS CloudTrail with log-file integrity validation. Logs are retained centrally and reviewed.
Continuous monitoring
Amazon GuardDuty inspects account activity, network flows, DNS, storage access, and database logins for threats around the clock. Findings are routed to our security channel and email within minutes. Application errors and performance are monitored in real time.
Resilient by design
The production database runs Multi-AZ with automated daily backups, point-in-time recovery, and deletion protection. The application tier is serverless on a global edge network with automatic DDoS mitigation. Recovery procedures are tested.
Secure development
All changes ship through pull requests with required review, protected branches, and automated checks: type checking, unit and integration tests, dependency vulnerability scanning with a blocking gate, static analysis, and secret detection. Production deploys only from the main branch.
Compliance program
- HIPAA
- Security, Privacy and Breach Notification Rule controls implemented; Business Associate Agreements in place with every subprocessor that touches PHI, and available to customers on request.
- PCI DSS
- Card data never touches EonPro systems. Payments are processed by Stripe (PCI DSS Level 1); EonPro operates in SAQ-A scope.
We maintain written information-security policies covering access control, cryptography, change management, incident response, business continuity, vendor management, risk management, and workforce security. Policies are reviewed and approved at least annually.
Where data lives
All customer and patient data is stored in the United States. Production and staging environments are fully separate, with distinct databases, credentials and network rules; production data is never copied into non-production environments.
Subprocessors
| Provider | Purpose | Region |
|---|---|---|
| Amazon Web Services | Database, object storage, key management, monitoring | US (Ohio) |
| Vercel | Application hosting and edge network | US |
| Stripe | Payment processing | US |
| Twilio / SendGrid | SMS and email delivery | US |
| OpenAI | Clinical documentation drafting (API, no training on customer data) | US |
| Sentry | Error and performance monitoring (PII scrubbed) | US |
Pharmacy partners receive prescriptions only for patients a clinic has chosen to route to them, under Business Associate Agreements. Customers are notified before a new subprocessor handles PHI.
Report a vulnerability
We welcome reports from security researchers. Email contact@eonpro.io with a description and reproduction steps. We acknowledge reports within two business days, will not pursue legal action against good-faith research that respects patient privacy, and ask that you do not access, modify or retain any data that is not your own.
Suspected misuse, privacy concerns, or ethics issues can also be reported anonymously through our Report a Concern channel.