Certifications & Standards
Independently verified by accredited certification bodies.
🏅
ISO 27001
Information Security Management System — the internationally recognised baseline for organisational information security. Covers risk management, access controls, incident response, and continual improvement.
🏥
ISO 27799
Healthcare-specific extension of ISO 27001, aligned with Israeli Ministry of Health directives on medical information security. Sets a higher bar for patient data protection beyond the general standard.
📋
Israeli Privacy Regulations
Full compliance with Israel's Privacy Protection Regulations (תקנות הגנת הפרטיות). Includes mandatory data security measures, breach notification requirements, and data subject rights.
Technical Security Measures
Protections built into every layer of the platform — from data at rest to how sessions are managed in the browser.
Data Protection
- ✓ Encryption at rest — all patient records, session notes, recordings, and transcripts are encrypted using AES-256; no plaintext data is written to disk
- ✓ Encryption in transit — all API and browser traffic is TLS 1.3; older protocol versions are rejected
- ✓ Isolated tenant storage — each clinic's data is stored in a logically isolated partition; cross-tenant data access is architecturally impossible
- ✓ Encrypted backups — automated daily backups, stored in a separate geographic region, retained for 90 days
- ✓ Zero standing access — Sherpii engineering staff have no standing access to production data; access requires time-limited approval and is fully audited
Authentication & Session Security
- ✓ SSO via Cognito — federated login through AWS Cognito; no passwords stored in Sherpii's own database
- ✓ Multi-factor authentication (MFA) — required for all accounts; TOTP app or SMS one-time code
- ✓ Device recognition — logins from unrecognised devices trigger an additional verification challenge
- ✓ Automatic session logout — inactive sessions are terminated after a configurable idle period (clinic-level setting)
- ✓ Session audit trail — every login, logout, and token refresh is logged with timestamp, device fingerprint, and IP
- ✓ Concurrent session control — clinic admins can restrict or terminate active sessions from the admin panel
Infrastructure & Ongoing Testing
Security is not a launch-time checklist — it is a continuous operational discipline.
Penetration Testing
Regular application penetration tests are conducted by independent third-party security firms. Tests cover authentication flows, API endpoint authorisation, injection vectors, session management, and data exfiltration paths. Findings are remediated within defined SLAs and results are available to enterprise customers under NDA.
Infrastructure Security
- ✓ Hosted on AWS (eu-west-1 and il-central-1 regions) with VPC isolation
- ✓ WAF (Web Application Firewall) blocking common attack patterns
- ✓ DDoS protection via AWS Shield
- ✓ Container images scanned for known CVEs on every build
- ✓ Secrets managed via AWS Secrets Manager — no credentials in code or environment files
- ✓ Security events streamed to SIEM with alerting on anomalous patterns
Regulatory Compliance
Sherpii is designed for multi-jurisdiction operation — primary compliance targets are Israel, the EU, and the US.
🇮🇱
Israel
- ✓ Privacy Protection Regulations (תקנות הגנת הפרטיות)
- ✓ Ministry of Health medical data directives
- ✓ Israel Tax Authority reporting requirements (יומן רופא)
- ✓ Patient consent records with timestamp and signature
🇪🇺
European Union
- ✓ GDPR — lawful basis for processing, consent management, right to erasure
- ✓ Data residency options (EU region hosting)
- ✓ Data Processing Agreements (DPA) available for enterprise accounts
- ✓ 72-hour breach notification capability
🇺🇸
United States
- ✓ HIPAA-aligned technical safeguards
- ✓ Business Associate Agreement (BAA) available
- ✓ PHI handling with access logging and minimum necessary access
- ✓ US region hosting option (us-east-1)
Data Access & Portability
Patients and therapists have full rights over their data — Sherpii never holds data hostage.
Therapist Access
- ✓ Full export of all clinic data at any time — patient records, sessions, invoices, messages
- ✓ Immutable audit log: every record access, edit, message, and login with timestamp and user identity
- ✓ Exportable in Excel, PDF, and CSV formats
- ✓ Data retained for 7 years post-account closure per healthcare regulations; then securely deleted
Patient Rights
- ✓ Patients can request a copy of their records via the therapist (GDPR Article 15 / Privacy Regulations)
- ✓ Right to erasure honoured within regulatory retention limits
- ✓ Consent records timestamped and versioned — patients can withdraw consent at any time
- ✓ Recordings and transcripts deleted on patient request; action is logged in the audit trail
Responsible Use
Security is a shared responsibility. Sherpii provides the infrastructure — therapists keep their end strong.
Account Security Recommendations
- ✓ Use a strong, unique passphrase — length matters more than complexity
- ✓ Enrol a TOTP authenticator app (preferred over SMS MFA)
- ✓ Log out when leaving a shared or unattended device
- ✓ Review active sessions in account settings periodically
- ✓ Report suspicious logins or unfamiliar access immediately to support
Clinical Data Handling
- ✓ Obtain patient consent before enabling recording — Sherpii surfaces a consent prompt at session start
- ✓ Configure the minimum necessary access level for each team member
- ✓ Review and archive inactive patient records to reduce unnecessary exposure
- ✓ Use Sherpii's messaging channels (not personal WhatsApp) for clinical communication — messages are then part of the audited record