Trust Centre: security and privacy at C-Encode
Security program built on SOC 2 and managed in Comp AI
Compliance Overview
Frameworks our program is built on
SOC 2
Security, Availability, Processing Integrity, Confidentiality, Privacy
Audit planned for 2027
PIPEDA
Federal private-sector privacy law
Designed to meet
Provincial health privacy acts
PHIPA (ON) and equivalents in other provinces
Designed to meet
Security and privacy at C-Encode
35 security controls across 5 areas, managed in Comp AI
C-Encode builds DXA Encode and C-Document for Canadian imaging clinics and hospitals. Patient data is hosted in Canada (AWS ca-central-1), encrypted in transit and at rest, and handled under agreements with our clinic and hospital customers. Our security and privacy program is designed to meet PIPEDA and PHIPA.
Our security program is built on all five SOC 2 Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality and Privacy) and managed in Comp AI. We plan to complete a SOC 2 audit in 2027.
Subprocessors
Third parties that process clinic, hospital or customer data on our behalf
- Amazon Web Services • Cloud hosting for DXA Encode and C-Document, including databases that hold patient data. Canada (Central) region.
- Microsoft 365 • Company email, collaboration and staff sign-in (single sign-on with multi-factor authentication). Data stored in Canada.
- Zoho • Customer support desk, remote support sessions and e-signature. Canadian data centre.
- HubSpot • Customer relationship management (business contact details only).
Frequently asked questions
In Canada, in Amazon Web Services' Canada (Central) region (ca-central-1). Backup copies are kept in a separate AWS account, also in Canada.
Data is encrypted at rest (AWS KMS) and in transit (TLS). Staff reach production systems only through single sign-on with multi-factor authentication, except documented emergency access, with least-privilege access that is reviewed every quarter.
Our security program is built on the SOC 2 Trust Services Criteria and managed in Comp AI. We plan to complete a SOC 2 audit in 2027. Our policies and supporting evidence are available on request under NDA.
Production databases are backed up daily with 30-day point-in-time recovery, and copies are kept in a separate AWS account. Restores are tested; our most recent test, in October 2026, restored the production database in under 20 minutes. Our recovery targets are 24 hours.
Our AWS environment is monitored with automated alerting (AWS GuardDuty and CloudTrail), and we follow a documented incident response plan. If a breach affects a clinic or hospital customer's data, we notify them at the first reasonable opportunity and no later than 72 hours after the breach is confirmed.
Our subprocessors are listed on this page. Clinic and hospital customers are informed of subprocessors that handle personal health information, as our customer agreements require.
Servers are patched regularly, and code changes run through automated secret scanning, static analysis and AI-assisted review, with a monthly independent review of changes.
Email security@c-encode.com. We share our policies and supporting evidence under NDA.
Cookies on c-encode.com
With your permission we use analytics cookies (Google Analytics and HubSpot) to understand how the site is used. No patient information is ever collected on this website. See our privacy policy.