Security & Trust
Built to protect the data healthcare depends on
ComplifyHealth is a compliance platform, so security is not a feature we add later. Our controls are designed around ISO/IEC 27001:2022 and Singapore's Personal Data Protection Act from day one.
Frameworks we align to
These frameworks govern how we design, operate and review the platform.
PDPA 2012
Personal Data Protection Commission
Consent, purpose limitation, protection, retention and breach notification obligations for personal data.
ISO/IEC 27001:2022
International Organization for Standardization
Information security management controls (Annex A) used as the reference model for our internal security programme.
MOH & HCSA
Ministry of Health, Singapore
Healthcare Services Act licensing requirements and MOH guidance relevant to the records our customers manage.
Core security controls
Encryption by default
Data is encrypted at rest with AES-256 and in transit with TLS 1.2 or higher. No data travels or rests in plaintext.
Singapore data residency
Customer compliance data is hosted on infrastructure located in Singapore and remains subject to Singapore law.
Least-privilege access
Role-based access control, multi-factor authentication and quarterly access reviews for every internal account.
No patient clinical records
ComplifyHealth processes compliance metadata only. We do not ingest or store patient clinical records from connected systems.
Continuous monitoring
Centralised logging, anomaly alerting and documented incident response procedures aligned to PDPC breach-notification timelines.
Immutable audit trails
Every compliance action is timestamped and append-only, giving auditors verifiable evidence of who did what, and when.
Need our security documentation?
Procurement and IT teams can request our security overview and data processing terms. To report a vulnerability, email security@complifyhealth.com.