Our Commitment

At Athelas, we understand that trust is earned through transparency, reliability, and integrity.

Our platform powers healthcare innovation while maintaining the highest standards of security, privacy, and compliance. Athelas connects care teams, patients, and technology securely: every interaction, every time, because patient data protection isn’t optional.

Get a demo

Handshake between a doctor and another person

Security

We take a defense-in-depth approach to security at every layer of our infrastructure.

Data Protection

Encryption at rest: AES-256 encryption for all stored data
Encryption in transit: TLS 1.2+ with perfect forward secrecy
Key management: Hardware security modules (HSMs) and automated key rotation

Access & Identity

Multi-factor authentication (MFA): Required for all user accounts
Role-based access control (RBAC): Principle of least privilege across all systems
Single sign-on (SSO): Enterprise identity provider integration (Okta, Azure AD, Google Workspace)
Session management: Automatic timeout and device fingerprinting

Infrastructure Security

Intrusion detection: 24/7 automated monitoring with real-time alerting
DDoS protection: Multi-layer mitigation at edge and application layers
Data residency: US-based infrastructure in HIPAA-compliant data centers

Experience Innovation Firsthand

Vulnerability management: Automated scans and frequent patch cycles
Penetration testing: Annual third-party security assessments

Compliance

Commure, Athelas’s parent company, adheres to industry-leading frameworks for healthcare data protection.

SOC 2 Type II

Audited by an independent third party
(in progress / certified).

HIPAA Compliance

Audited by an independent third party
(in progress / certified).

GDPR & CCPA

We support international privacy regulations for data subjects’ rights.

Privacy

We treat patient and customer data with the respect and protection it deserves.

Our Privacy Principles

No data selling: We never sell, rent, or share Protected Health Information (PHI) or customer data
Purpose limitation: Data is only processed to deliver, improve, and support our products
Data ownership: Customers retain full ownership and control of their data
Transparency: Clear documentation of data practices and processing activities

Data Rights

Access: Request copies of your data at any time
Portability: Export data in standard formats (FHIR, CSV, JSON)
Deletion: Request deletion of data subject to legal retention requirements
Correction: Update or correct inaccurate information

Data Processing

Minimal collection: We collect only data necessary for service delivery
Retention limits: Data retained according to documented schedules and customer contracts
Subprocessor oversight: All vendors undergo security and privacy reviews
Cross-border transfers: Standard Contractual Clauses (SCCs) for international data flows

Hands typing on a laptop with a digital lock shield overlay representing cybersecurity

Scientist in a lab using a tablet, with lab equipment in the background.

Digital network diagram with connected files and a central analytics document icon.

Reliability & uptime

Our commitment to reliability ensures healthcare operations run smoothly.

99.9%

Uptime Target

Real-Time Status

status.commure.com

Incident Transparency

All incidents and resolutions are publicly tracked via an Incident.io integration.

Disaster Recovery

Tested quarterly with full backup and recovery plans.