CareLumi Security Policy

1. Commitment to Security

CARELUMI is deeply committed to maintaining industry-leading security standards to protect all information processed and stored through our services.

2. Data Encryption

We use industry-standard AES-256 encryption to secure data both in transit and at rest. Sensitive information and personal data stored within the CARELUMI platform are always encrypted, ensuring maximum confidentiality and protection.

3. Compliance Certifications

CARELUMI is compliant with major security and privacy standards, including:

• SOC 2 Type II Compliance
• HIPAA Compliance
• GDPR Compliance

4. Secure Infrastructure

Our services are hosted securely on Amazon Web Services (AWS), a trusted industry leader in cloud computing. AWS provides comprehensive physical and operational security measures and maintains stringent standards for data privacy and protection.

Our security infrastructure includes:

• Regular encrypted backups
• Disaster recovery protocols
• Routine vulnerability assessments and penetration testing

5. Access Controls

We strictly enforce Role-Based Access Control (RBAC), ensuring users only have access to data necessary for their roles. Multi-factor authentication (MFA) is required for all access to the CARELUMI platform, significantly reducing unauthorized access risk.

6. Monitoring and Incident Response

CARELUMI continuously monitors system activity, ensuring swift identification and response to security incidents. Our dedicated security team maintains a rigorous incident response plan designed to address and mitigate potential security threats promptly and effectively.

7. Employee Security

All CARELUMI employees undergo regular security awareness training. Strict internal policies regarding data handling, confidentiality, and privacy are enforced, and employees are required to sign confidentiality agreements.

8. Reporting Security Concerns

We encourage users to report any security concerns or vulnerabilities immediately. Please contact us at hello@carelumi.com to report security issues or vulnerabilities.