Mpirik is now part of Tempus 🎉

Security & Compliance

Security and compliance are top priorities for Mpirik because they are fundamental to your experience with the product. Mpirik is committed to securing your application's data and Protected Health Information, eliminating systems vulnerability, and ensuring continuity of access.

Mpirik uses a variety of industry-standard technologies and services to secure your data from unauthorized access, disclosure, use, and loss. All Mpirik employees undergo background checks before employment and are trained on security practices during company onboarding and on an annual basis.

Security and Compliance are directed by Mpirik's Head of Technology and Head of Security and Compliance. Security and compliance are maintained by Mpirik's Security & Operations team.

HIPAA and HITECH

Mpirik data is hosted on AWS, which encrypts all data at rest and in transit by default, in compliance with the Privacy Rule within HIPAA Title II. Mpirik also exercises strong access control, technical,administrative, physical and operational safeguards in compliance with HIPAA's Security Rule.

Mpirik signs a Business Associate Agreement (BAA) with all Enterprise customers and subcontractors to ensure compliance with the Health Insurance Portability and Accountability Act (HIPAA), amended by the Health Information Technology for Economic and Clinical Health Act (HITECH).

Vulnerability Disclosure

If you would like to report a vulnerability or have any security concerns with a Mpirik product, please contact security@mpirik.com.

Include a proof of concept, a list of tools used (including versions), and the output of the tools. We take all disclosures very seriously. Once disclosures are received, we rapidly verify each vulnerability before taking the necessary steps to fix it. Once verified, we periodically send status updates as problems are fixed.

Infrastructure and Network Security

Physical Access Control

Mpirik is hosted on Amazon Web Services(AWS). AWS data centers feature a layered security model, including extensive safeguards such as:

  • Custom-designed electronic access cards
  • Alarms
  • Vehicle access barriers
  • Perimeter fencing
  • Metal detectors
  • Biometrics

According to the AWS Security Whitepaper: “The data center floor features laser beam intrusion detection. Data centers are monitored 24/7 by high-resolution interior and exterior cameras that can detect and track intruders. Access logs, activity records, and camera footage are reviewed in case an incident occurs. Data centers are also routinely patrolled by professional security guards who have undergone rigorous background checks and training.”

Mpirik employees do not have physical access to AWS data centers, servers, network equipment, or storage.

Logical Access Control

Mpirik is the assigned administrator of its infrastructure on AWS, and only designated authorized Mpirik operations team members have access to configure the infrastructure on an as-needed basis behind a two-factor authenticated virtual private network. Specific private keys are required for individual servers, and keys are stored in a secure and encrypted location.

Penetration Testing

Mpirik undergoes black box penetration testing conducted by an independent, third-party agency, on an annual basis. For black-box testing, Mpirik provides the agency with an isolated clone of Mpirik's platform URL and a high-level diagram of application architecture.

Information about any security vulnerabilities successfully exploited through penetration testing is used to set mitigation and remediation priorities. Mpirik will provide a summary of penetration test findings upon request to Enterprise customers.

Third-Party Audit

AWS undergoes various third-party independent audits regularly and can provide verification of compliance controls for its data centers, infrastructure, and operations. Mpirik undergoes third-party independent audits on a regular basis and can provide compliance artifacts upon request.

Intrusion Detection and Prevention

Unusual network patterns or suspicious behavior are among Mpirik's most significant concerns for infrastructure hosting and management. Mpirik and AWS's intrusion detection and prevention systems (IDS/IPS) rely on both signature-based security and algorithm-based security to identify traffic patterns that are similar to known attack methods.

IDS/IPS involves tightly controlling the size and make-up of the attack surface, employing intelligent detection controls at data entry points, and developing and deploying technologies that automatically remedy dangerous situations, as well as preventing known threats from accessing the system in the first place.

Mpirik does not provide direct access to security event forensics but does provide access to the engineering and customer support teams during and after any unscheduled downtime.

Business Continuity and Disaster Recovery

High Availability

Every part of the Mpirik service uses properly-provisioned, redundant servers (e.g., multiple load balancers, web servers, replica databases) in the case of failure. As part of regular maintenance, servers are taken out of operation without impacting availability.

Business Continuity

Mpirik keeps continuous and incremental encrypted backups of data. While never expected, in the case of production data loss (i.e., primary data stores lost), we will restore organizational data from these backups.

Disaster Recovery

In the event of a region-wide outage, Mpirik will bring up a duplicate environment in a different AWS region. The Mpirik operations team has extensive experience performing full region migrations.

Data Security and Privacy

Data Encryption

All data in Mpirik servers is encrypted at rest. AWS stores and manages data cryptography keys in its redundant and globally distributed Key Management Service. If an intruder were ever able to access any of the physical storage devices, the Mpirik data contained therein would still be impossible to decrypt without the keys, rendering the information a useless jumble of random characters.

Encryption at rest also enables continuity measures like backup and infrastructure management without compromising data security and privacy.

Mpirik exclusively sends data over HTTPS transport layer security (TLS) encrypted connections for additional security as data transits to and from the application.

Data Removal

Please contact support@mpirik.com for any specific data removal requests

Application Security

Two-Factor Authentication

In addition to password login, two-factor authentication (2FA) provides an added layer of security to Mpirik via a time-based one-time password algorithm (TOTP). Mpirik enforces 2FA for access to internal resources and the Platform.

Mpirik end-users can increase security with universal second-factor devices like TOTP apps like Google Authenticator. This also applies to sign-in with an SSO provider.Mpirik's organization list also displays who has 2FA enabled so users can vet their own organization's security.

Single Sign-On

Mpirik uses Single Sign-On for access to all internal resources.

Federated authentication can be configured on a per organization basis to integrate the Mpirik software with your existing identity infrastructure.

Email Security

The Mpirik service includes email notifications and reports. Sender policy framework (SPF) is a system to prevent email address spoofing and minimize inbound spam. We have SPF records set through Dyn, our domain name service (DNS), and domain-based message authentication, reporting, and conformance (DMARC) set up for monitoring reports to prevent the possibility of phishing scams.

Secure Application Development (Application Development Lifecycle)

Mpirik practices continuous delivery, which means all code changes are committed, tested, shipped, and iterated on in a rapid sequence. A continuous delivery methodology, complemented by pull request, continuous integration (CI), and automated error tracking, significantly decreases the likelihood of a security issue and improves the response time to and the effective eradication of bugs and vulnerabilities.

Corporate Security

Malware Protection

At Mpirik, we believe that good security practices start with our own team, so we go out of our way to protect against internal threats and local vulnerabilities. All company-provided workstations run Kandji for inventory management which enables and enforces full-disk encryption, screen lock, and other security features.

Risk Management

Mpirik follows the risk management procedures outlined in NIST SP 800-30 which include nine steps for risk assessment and seven steps for risk mitigation.

All Mpirik product changes must go through code review, CI, and build pipeline to reach production servers. No one, including the Mpirik operations team has access to production servers.

We perform testing and risk management on all systems and applications on a regular and ongoing basis. New methods are developed, reviewed, and deployed to production via pull request and internal review. New risk management practices are documented and shared via staff presentations on lessons learned and best practices.

Mpirik performs risk assessments throughout the product lifecycle per the standards outlined in HIPAA Security Rule, 45 CFR 164.308:

  • Before the integration of new system technologies and before changes are made to Mpirik physical safeguards.
  • While making changes to Mpirik physical equipment and facilities that introduce new, untested configurations.
  • Periodically as part of technical and non-technical assessments of the security rule requirements as well as in response to environmental or operational changes affecting security.

Contingency Planning

The Mpirik operations team includes service continuity and threat remediation among its top priorities. We keep a contingency plan in case of unforeseen events, including risk management, disaster recovery, and customer communication sub-plans that are tested and updated on an ongoing basis, thoroughly reviewed for gaps and changes at least annually, and tested annually.

Security Policies

Mpirik maintains an internal wiki of security policies, which is updated on an ongoing basis and reviewed annually for gaps. An overview of specific security policies is available to Mpirik customers upon request:

  • Information Security
  • Risk Management
  • Security Incident Response
  • Vulnerability Management
  • Policy Management and Maintenance
  • Data Request
  • Change Management
  • System Access
  • Background Checks

Background Checks

Mpirik conducts background checks for all new hires via Goodhire, including verification on the following:

  • Identity verification
  • Sex offender registry check
  • Global watchlist check
  • National criminal records check
  • County criminal records check
Security Training

All new employees receive onboarding and systems training, including environment and permissions setup, formal software development training (if pertinent), security policies review, company policies review, and corporate values and ethics training.

All engineers review security policies as part of onboarding and are encouraged to review and contribute to policies via internal documentation. Any change to policy affecting the product is communicated as a pull request, such that all engineers can review and contribute before internal publication. Major updates are communicated to all Mpirik employees.

Disclosure Policy

Mpirik follows the incident handling and response process recommended by SANS, which includes identifying, containing, eradicating, recovering from, communicating, and documenting security events. Mpirik notifies customers of any data breaches as soon as possible via email and phone call, followed by multiple periodic updates throughout each day addressing progress and impact. Mpirik Enterprise plans include a dedicated customer success manager who holds responsibility for customer communication, as well as regular check-ins and escalations.

Mpirik maintains a live report of operational uptime and issues on our status page. Anyone can subscribe to updates via email from the status page. Any known incidents are reported there.

More information

More information regarding Mpirik's security controls can be found here.