Security is not a badge on the bottom of a website. It is how access is controlled, how data moves, how systems are watched, how incidents are handled, and how clearly a vendor answers uncomfortable questions.
SOC 2 assurance work is in preparation. This page does not represent a completed certification or independent report.
That means encrypted connections, controlled access, auditability, monitored infrastructure, data portability, incident-response practices and a security programme being prepared for independent SOC 2 assurance. We do not call an in-progress audit a completed certification.
Sensitive application traffic uses encrypted connections, and stored data is protected using the controls provided by the underlying infrastructure and service architecture.
Encryption is a baseline control, not the whole security model.
PawthosX is designed around role- and permission-aware access so teams can limit who can see, change or perform sensitive actions.
Least privilege matters more than a long list of roles.
A practice should not have to surrender control of its history in order to use modern software. PawthosX is built with export and migration in mind.
Export scope still depends on the data, agreement and legal obligations.
Critical systems, changes and security-relevant activity should be observable. PawthosX uses monitoring, logging and operational review as part of how the service is run.
We avoid pretending a green dot is the same thing as reliability.
PawthosX is designed around migration and portability because a clinic should be able to understand what data it has, move it when appropriate and avoid artificial lock-in.
Export availability, format, retention and deletion can depend on the specific data type, the clinic's agreement, applicable law and operational requirements.
Security language should get more precise as the stakes get higher, not more theatrical.
PawthosX uses a layered security approach that includes encrypted network connections, encryption for stored data, controlled access, auditability, monitored infrastructure and documented operational controls. Exact controls can vary by service and deployment.
Yes. PawthosX is designed around role- and permission-aware access so practices can limit access to the information and actions people need for their work.
PawthosX is built around data portability. Export scope, format and timing depend on the data involved, the clinic's agreement, legal obligations and the tools available for that data type.
PawthosX is preparing its controls and evidence for formal SOC 2 assurance work. The site should not be read as claiming a completed SOC 2 report unless PawthosX explicitly publishes that status.
Veterinary patient records generally are not governed by HIPAA in the same way human medical records are. PawthosX still applies security principles familiar from regulated software, including least privilege, encryption, auditability and controlled access.
The PawthosX security page provides a deeper overview of access control, data security, monitoring, recovery, vendor management and assurance. Additional documentation can also be requested from PawthosX.
If your IT, ownership, legal or security team wants the deeper version, ask. The answer should not be “trust us.”