Security & Trust

Shadowfax production systems are hosted in U.S.-based Google Cloud infrastructure. We use managed services and centralized monitoring so production infrastructure can be operated consistently and reviewed during security due diligence.

Data is transmitted over HTTPS/TLS 1.2 or newer and encrypted at rest in Google Cloud. For customer environments, Shadowfax also uses customer-specific encryption controls as part of its tenant isolation model.

Customer environments use logical tenant isolation and customer-specific encryption controls. This is designed to keep each customer environment separated while preserving the operational benefits of managed cloud infrastructure.

Shadowfax has disaster recovery measures appropriate to the current production architecture, including Google Cloud managed services, managed database backups, source-controlled application code, repeatable deployment procedures, monitoring and logging, and internal incident recovery procedures. Formal RTO and RPO commitments are defined during implementation planning based on the final production architecture and contractual requirements.

Yes. Shadowfax supports multi-factor authentication for administrative access and general user access. MFA is part of the broader access control model used to protect production systems and customer environments.

Access permissions are scoped by role. Critical internal systems, applications, and environments are reviewed quarterly so access can be validated and adjusted as responsibilities change.

Shadowfax logs authentication events, account creations, account modifications, account deletions, successful login sessions, failed login attempts, and sensitive-data actions for authorized review.

PHI access events are captured in retention-locked audit logs designed to prevent alteration or deletion. The logging model covers access, viewing, modification, and removal activity by user and service accounts for systems that handle PHI.

Shadowfax retains PHI access audit logs for a minimum of six years as HIPAA-aligned security documentation. Scoped audit reports can be provided for authorized legal, regulatory, contractual, security, or incident-review purposes.

No. Customer data is processed to provide the service and is governed by customer agreements and BAAs where applicable. It is not used to train foundation models or internal AI models.

AI assists workflows, but clinicians remain responsible for reviewing, editing, and approving clinical output. Shadowfax is designed to support radiologists and clinical teams, not replace professional review.

Remote-hosted systems use host-based controls and current anti-virus protections. Microsoft Defender for Endpoint compatibility is supported for customer environments that require it.

Shadowfax conducts penetration testing twice a year for production systems. Findings are reviewed and prioritized by engineering so remediation can be planned based on severity, exposure, and operational risk.

Security and audit logs are aggregated into centralized monitoring systems. Raw log access is restricted, but scoped audit reporting can be provided for authorized review needs.

All employees complete cybersecurity and information security training twice a year. Training covers social engineering, password management and security, organizational data classifications, and asset management expectations.

Yes. Shadowfax conducts phishing simulations to reinforce social engineering awareness and help employees practice recognizing and reporting suspicious messages. Simulations can also be adjusted based on emerging threats or training needs.

Incident response plans and common incident playbooks are reviewed periodically and after material security incidents, significant architectural changes, or major tabletop findings. Security and incident response inquiries can be directed to Shadowfax through the security contact path.