Encryption & Data Protection

ConnectHL7 protects customer data — including protected health information (PHI) — with strong encryption at every stage: while it moves across networks, while it sits at rest, and while our systems access the secrets needed to operate. This page describes our approach at a level appropriate for security review, without disclosing implementation details that could weaken those protections.

---

Encryption in transit

All data transmitted to, from, and within the ConnectHL7 platform is encrypted using TLS 1.2 or higher.

• Connections to our public endpoints (including our APIs) require modern TLS. Legacy protocol versions and weak cipher suites are not permitted.
• Healthcare messages exchanged through the platform travel over encrypted channels end to end within our environment.
• Internal service-to-service communication within our AWS environment is likewise protected in transit.

This means that data is never transmitted in cleartext over untrusted networks.

---

Encryption at rest

All customer data stored by ConnectHL7 is encrypted at rest using industry-standard AES-256 encryption.

• Our primary datastores (including our relational databases) are encrypted at rest.
• Object storage and message queues that hold customer data are encrypted at rest.
• Backups are encrypted at rest as well — see Business Continuity & Disaster Recovery.

Encryption at rest is enabled by default across our data stores, not applied selectively.

---

Secrets management

Credentials, API keys, and other sensitive configuration values are managed through AWS Secrets Manager, a purpose-built, access-controlled secrets store.

• Secrets are encrypted at rest and retrieved by our services only at runtime.
• Secrets are never stored in source code or committed to our source control. Our development pipeline includes automated secret scanning to enforce this.
• Access to secrets follows least-privilege principles and is logged.

---

Key management (high level)

Encryption keys are managed using AWS's managed key infrastructure (AWS KMS):

• Keys are generated, stored, and protected within AWS's hardware-backed key management service.
• Access to keys is tightly restricted following least-privilege principles, and key usage is logged for auditability.
• The ability to disable or delete keys is limited to a small number of authorized administrators and monitored.

We intentionally rely on AWS's proven, independently attested key management rather than building our own — a deliberate choice to reduce risk.

---

Secure communications

Beyond transport encryption, we protect the integrity and authenticity of communications:

• API access requires authenticated, authorized credentials (see Infrastructure & Architecture for authentication and authorization).
• Administrative access to our environment is restricted, authenticated with multi-factor authentication, and logged.
• We minimize direct network exposure; systems are private by default and reachable only through controlled, monitored paths.

---

Data integrity

Protecting data means ensuring it is not only confidential but also accurate and unaltered:

• Encrypted transport protects messages against tampering while in transit.
• Access to modify data is limited by role-based, least-privilege controls, and administrative and system activity is logged.
• Our change management and secure development practices (see Infrastructure & Architecture) reduce the risk of defects that could affect data integrity.
• Our backup and recovery approach allows us to restore data to a known-good state if needed (see Business Continuity & Disaster Recovery).

---

Data handling and PHI

We treat all customer data as sensitive by default, and PHI with the highest level of protection:

• PHI is encrypted in transit and at rest and is accessible only to the minimum necessary systems and personnel.
• We do not use customer PHI for any purpose other than providing the ConnectHL7 service, consistent with our contractual and regulatory obligations.
• We enter into Business Associate Agreements (BAAs) with customers where required under HIPAA.

For questions about data location, retention, or processing, see our Security FAQ or contact privacy@connecthl7.com.

---

Related: Security Overview · Infrastructure & Architecture · Business Continuity & Disaster Recovery · Security FAQ

Last updated: 1 July 2026