At BrainSpec, protecting patient privacy and securing clinical data is foundational to our mission. As a provider of advanced Software as a Medical Device (SaMD), we recognize that safeguarding Protected Health Information (PHI) and ensuring system availability are just as critical as the clinical accuracy of our algorithms.
BrainSpec maintains a rigorous, continuous compliance program designed to meet the strict demands of both the healthcare and technology sectors. Our security policies are built on the principles of least privilege, defense-in-depth, and continuous monitoring.
BrainSpec is deeply invested in maintaining robust security and has established a dedicated security program guided by an independent security expert. Reporting directly to our CEO, this role manages and continuously matures our comprehensive compliance posture. Our security lead serves as a direct bridge to our healthcare partners, ensuring their specific security requirements are met, while working hand-in-hand with our engineering and product developers to embed security best practices into everything we build.
Data in Transit: All data transmitted between clinical sites, users, and the BrainSpec platform is encrypted using TLS 1.2 or higher over secure HTTPS connections, preventing interception or tampering over insecure networks.
Data at Rest: All data stored within our infrastructure is encrypted at rest using industry-standard AES-256 encryption.
Penetration Testing
BrainSpec engages independent, industry-leading security experts to conduct comprehensive penetration testing at least annually. These assessments ensure our software remains highly resilient against emerging threats. Summary penetration test reports are available for review via our Trust Center.
Vulnerability Scanning
To proactively identify and mitigate risks, BrainSpec requires continuous vulnerability scanning at key stages of our Secure Development Lifecycle (SDLC). This includes automated security testing of our code, third-party dependencies, and running applications before any changes are deployed to production.
Infrastructure Security
Our core platform is hosted on Google Cloud (GCP), combining world-class physical infrastructure with strict, clinical-grade engineering controls. We leverage advanced, cloud-native security features to maintain a continuously monitored and highly available environment for critical clinical workflows.