Security at Althio

Encryption

Information is encrypted in transit with TLS and at rest with AES-256. Encryption keys are managed separately from the data they protect.

Access

Access to patient information is role-based and scoped to the treating team. Every access to a patient’s record is logged. Staff at Althio reach production systems only through a separate, audited path, and only when their work requires it.

Hosting

Althio runs on Amazon Web Services under a business associate agreement. Systems that hold patient information are kept in their own account, apart from development and internal tools.

Logging and monitoring

Security-relevant events are logged and monitored. Logs are filtered so that they do not carry patient content.

Sign-in

Each person signs in with their own account. Practices decide who has access and can remove it at any time.

SOC 2 Type II

Althio’s SOC 2 Type II audit is in progress with A-LIGN, an independent audit firm. The observation period began on 1 November 2026. A Type II report covers how our controls operate over that whole period, so it is issued once the period ends. Until then we do not claim SOC 2 compliance, and we will share our readiness status with any practice that asks.

Independent testing

Ask us for the current status of penetration testing. We will tell you what is complete and what is planned, and we will not claim a certification we do not hold.

Reporting a security issue

If you believe you have found a security issue, please write to hello@althio.ai.