Product · Security
Overlay was designed from day one for healthcare's strictest compliance requirements. Every architectural decision starts with protecting patient data.
Core Security
All data stored within Overlay is encrypted with AES-256. All data in transit uses TLS 1.3. Encryption keys are rotated automatically on a 90-day cycle and managed via a dedicated key management service.
Every user, system, and API call is authenticated before any data is accessible. Overlay enforces role-based access control at the field level, with short-lived session tokens and mandatory MFA for all administrative accounts.
Every action — data requests, approvals, denials, access events, and configuration changes — is written to an append-only, tamper-evident audit log. Logs are retained for seven years by default to meet HIPAA record-keeping requirements.
Overlay operates on a zero-trust model: no implicit trust is granted to any system, user, or network segment. Every request is verified, authorized, and logged regardless of its origin — even internal service calls.
Compliance
Overlay's compliance posture is built into the product, not bolted on afterward. Our controls are designed to meet HIPAA's technical, administrative, and physical safeguard requirements.
Scoped access permissions enforce HIPAA's requirement that only the minimum necessary data is accessed for each request.
Overlay executes a BAA with every customer before any PHI flows through the system. Available on all plans.
Automated alerting and incident response runbooks ensure you can meet HIPAA's 60-day breach notification requirement.
Overlay undergoes independent penetration testing annually. Results are available to enterprise customers under NDA.
Certifications & status
99.9% uptime guaranteed on all production environments. Status and incident history available at our public status page.
All services are deployed across multiple availability zones. No single data center failure can take Overlay offline.
All PHI processed and stored by Overlay remains within US data centers. We do not transfer patient data internationally.
We're happy to share our security documentation, walk through our architecture, or discuss your specific compliance requirements.