Trust and security

Encryption and sign-in

• Encrypted at rest with AES-256, using keys provisioned for your organization alone.
• Encrypted in transit with TLS 1.2 or higher.
• Single sign-on with your identity provider, including Microsoft Entra ID, ADFS, Shibboleth and LDAP, so your own password and multi-factor policies apply and passwords never reach Prismatic.
• Built-in accounts have a strict password policy, lockout after repeated failures, and optional multi-factor authentication.

Who can see what

• Role-based access control. Everyone starts with basic access, and your administrators designate manager-level users and set exactly what each one can see, including hiding personal information or making records read-only.
• Only your highest-level administrator can create other administrators.
• On Prismatic’s side, production access is restricted to a single named officer. Support staff work only inside your system, and only when assisting with a request you have raised.

Every change on the record

Every form keeps a Track Changes History of its data over time, and the system records every access to a form and by whom. Those records, and all of your data in standard export formats, are available to you on request, which is how clients meet freedom-of-information and audit obligations.

A dedicated environment for every client

Your organization runs in its own dedicated AWS account and its own private network. There is no shared multi-tenant environment, so cross-client access is eliminated by design and your data can be produced on its own, for example for a legal request, without touching anyone else’s.

Backups live in a second, separately secured AWS account with different credentials, so a compromise of the primary account cannot reach them. Storage and backups are replicated across multiple availability zones, separate data centres within the region, and a multi-zone high-availability deployment is available as an option.

Privacy by design in the product

• The incident form displays a collection notice on its first tab, before any information is entered.
• Automated notifications carry basic incident metadata only, never personal or medical detail.
• Return-to-work cases are visible only to designated case managers and the administrators you choose, and medical documents are encrypted, virus-scanned and access-restricted.
• Nothing is disposed of without your direction. When a contract ends, your database and all uploaded files are exported in standard formats at no charge and your dedicated environment, including backups, is decommissioned.

Working with your privacy and security reviews

We complete privacy impact assessments, cloud security questionnaires and Privacy Protection Schedules as part of contracting, and we answer your reviewers’ questions directly.