Wellthy Trust Center

Member data shared with Wellthy by members is encrypted at-rest via AES-256 and in-transit via TLS 1.2 or higher.

Wellthy manages personal information in accordance with GDPR, including how information is collected, processed, and disclosed.

Wellthy builds its products, programs, and culture around the foundations of HIPAA.

Yes. On an annual basis, a formal, written IT / Security risk assessment is conducted based on relevant frameworks, advisories, or regulatory requirements. Our annual security risk assessment typically follows the National Institute of Standard and Technology (NIST), International Organization for Standardization (ISO), or Health Insurance Portability & Accountability Act (HIPAA) framework to ensure we are reviewing our security posture across the most relevant frameworks.

Yes. Wellthy performs external and internal penetration testing with an accredited third-party at least once per year and after any significant infrastructure or application upgrade or modification. Penetration testing includes network-layer, host-layer, and application-layer penetration testing where applicable

Yes. Our incident response program includes a step-by-step playbook for how to escalate, respond, and recover to platform, security, and privacy incidents. It also includes steps to review and conduct a lessons learned exercise for any incident. We follow strict notification timelines that can be shared upon request, or are otherwise detailed in our agreement with you. Our incident response plan is reviewed and tested annually by leadership.

Yes. Notification can happen via our Intrusion Prevention System / Intrusion Detection System (IPS/IDS) or manually by escalating it to our incident point-of-contact or emailing security@wellthy.com. Upon notification, we at minimum collect the date and time the incident was discovered, how the incident was discovered, contact information of the person making the report (if applicable), the nature of the incident, the equipment / systems that are involved, and the location of the equipment involved to the incident response team.

Yes. Wellthy has a variety of tools in place that log and monitor actions on our website, platform, and devices. Automated tools provide real-time monitoring and notification of suspected wrongdoing and vulnerability exploitation in a range of Wellthy technology aspects including network, production environment, operating systems, potential security breaches via a host and network intrusion detection system, containers, and firewalls.

Wellthy’s systems are implemented to monitor key operational metrics and to notify appropriate personnel when certain operational thresholds are reached. To help prevent and mitigate downtime and program sponsor impact, the monitoring of these key operational metrics is automated. This monitoring includes but is not limited to storage and drive space availability, Central Processing Unit (CPU) and memory utilization, required patches and updates and antivirus alerts.