Technical and Organizational Measures
1. Introduction
This Technical and Organizational Measures (“TOM”) document covers the security and privacy controls for the Patient Interaction Suite by XUND.
With the Patient Interaction Suite, you identify possible causes for your symptoms using our database built from millions of medical publications powered by our artificial intelligence (AI). Based on self-reported data, XUND enables digital and automated interactions through relevant questions tailored to each stage in the patient journey. These features allow you to build customized health assistants for your patients.
This document provides a description of the main building blocks that contribute to the technical security and privacy of our Patient Interaction Suite and the organizational measures that surround the development and operation of the services. The target audience of the document is technicians and security and privacy experts who want to verify the details of the measures put in place by XUND.
2. Service Overview
Our Patient Interaction Suite consists of medical modules that cover the entire patient lifecycle and enable digital interactions from prevention to diagnosis and monitoring. It is a standalone software without any physical components or accessories that supports layman users by providing them with trustworthy medical information and preliminary symptom assessments in an intuitive and easy-to-understand way. By asking simple and short questions about the symptoms and profile of the user, XUND then provides a list of potential explanations and next steps. The Patient Interaction Suite can be integrated into any frontend with an internet connection via API, SDK, and Web App interfaces.
3. Service Architecture
The Patient Interaction Suite is a Software-as-a-Service (SaaS) solution running on a cloud provider in European data centers. The Suite is running in a containerized environment where the hosts are partially managed by the cloud provider and partially by XUND.
Additionally to the medical modules, there are also add-on services that among other things also allow the management of the client settings and easier integration of the patient-facing UI. These web components share the same architectural setup as the rest of the service. Settings applied in the Client Hub constitute as instructions in regard to the processing of personal data.
Personal data of patients is never consumed by the Patient Interaction Suite. For each patient interaction, a random check ID is generated that identifies questions and answers within a single session and produces a report. These check IDs are never mapped to any real profile information on the application backend. Therefore, data generated through the medical modules is legally not considered personal data, although it is protected to those standards on our servers.
4. Technical Controls
We employ industry-standard technical security controls appropriate to the nature and scope of the service, designed to safeguard the service infrastructure and data residing therein. The technical and organizational measures described here constitute the measures referenced in the Data Processing Agreement that is part of the Terms of Service.
4.1. Access Control
Logical access control procedures are in place, designed to prevent or mitigate the threat of unauthorized application access. Access for clients to the Patient Interaction Suite is provided based on API keys or pre-configured domain verification, whereas user authentication on client-facing UIs is done using a username and password combination with optional two-factor authentication. XUND employees are granted minimum (or “least privilege”) access to specified XUND systems, applications, and devices as needed. Further, user privileges are segregated based on functional role and environment.
4.2. Firewalls and Network Zones
XUND office networks and production networks are completely separated, with no VLAN connectivity between the two. Only required ports from application components are exposed within the service, and only containers containing the external proxies are exposed to the Internet.
4.3. Data Segregation
We leverage a multi-tenant architecture, logically separated at the database level, based on a user’s or organization’s account. Only authenticated parties are granted access to relevant accounts.
4.4. Physical Security
XUND leverages ISO27001-certified, European cloud providers with data centers providing physical security and environmental controls. These controls include:
- video surveillance and recording
- multi-factor authentication to highly sensitive areas
- heating, ventilation, and air conditioning temperature control
- fire suppression and smoke detectors
- uninterruptible power supply (“UPS”)
- continuous monitoring and alerting
- protections against common natural and man-made disasters, as required by the geography and location of the relevant data center
- scheduled maintenance and validation of all critical security and environmental controls
4.5. Business Continuity and Availability
The technical setup of the service allows dynamic scaling based on load and seamless handling of individual hardware errors. In case of data center failures, we can, within 1 business day, relocate the service to a different location and serve traffic from there.
There are daily full backups created of the complete database and kept within the same data center as well at a geographically distant location. Backups are encrypted at rest, and restoration capabilities are tested every 6 months.
4.6. Server Updates
Our core services run in containers based on minimal images that are updated with the latest security patches on every release. The few services that run in traditional virtual machines are continuously monitored for applicable security updates and patched depending on risk or at least receive full patching once a quarter.
4.7. Encryption
XUND maintains a cryptographic standard that aligns with recommendations from industry groups, government publications, and other reputable standards groups. This standard is periodically reviewed, and selected technologies and ciphers may be updated in accordance with the assessed risk and market acceptance of new standards.
All network traffic flowing in and out of XUND server components, as well as in-between, is encrypted in transit.
4.8. Vulnerability Management
External system and network vulnerability scanning is conducted monthly. Static application vulnerability testing is run on every build, and penetration testing activities for targeted environments are performed periodically. These scanning and testing results are reported into network monitoring tools and, where appropriate, remediation action is taken.
4.9. Logging and Altering
XUND logs all API requests and application errors with associated context for debugging purposes. Logs are forwarded to a central repository and cannot be modified. Only selected employees have access to these logs. Any errors causing possible service interruption are monitored, and internal alerting notifies developers of the issue.