Security
HIPAA-ready systems. SOC 2 data-center hosting. Encryption in transit and at rest. 2FA and SSO where the work requires it. Hands-on only — no outsourcing.
Keeping client data secure is a top priority at Citinet Solutions. We aim for a secure environment without sacrificing application performance or the people who use the software every day.
We hold government clearance, build HIPAA-ready systems, and maintain cybersecurity certifications. The same team that designs the workflow also owns how it is hosted and supported.
Citinet can host custom workflow software entirely on-site, in our data centers, or on Amazon Web Services (AWS) — with end-to-end security and privacy features built in.
We only use data centers that achieve SOC 2 Trust Services Principles focused on security. Continued SOC 2 certification means organizational and technology controls are independently audited at least annually.
AWS publishes an extensive list of compliance programs and third-party assessments for its data centers. When we deploy there, we inherit that foundation and add application-level controls on top.
Encryption in transit. Custom web application communications use TLS with strong cipher suites (commonly described as 256-bit SSL/TLS) so traffic cannot be read by a third party on the wire.
Encryption at rest. Workflow data is encrypted at rest using AES-256.
Access controls. Two-factor authentication (2FA) and single sign-on (SSO) are available where the engagement requires them, so accounts are not left on passwords alone.
Monitoring. We monitor security, performance, and availability on an ongoing basis, run automated security testing, and maintain cybersecurity certifications.
No outsourcing. No call centers. No ticket theater. Security posture includes who touches the system — and that is Citinet, not a subcontracted help desk.
For HIPAA-covered work, privacy and regulatory requirements are designed into the build and hosting choice from the start, not bolted on after go-live.
Tell us what you need to protect. We will tell you how we would host it — and what we would not promise.
