Boards, funders, and compliance committees regularly ask how CoolFocus protects the information you keep in it. This article lays out the practices behind the product, so you can hand it to them directly.
CoolFocus is built to serve organizations that handle sensitive personal and health information. The controls below reflect what that responsibility requires.
Is CoolFocus HIPAA compliant?
Yes. CoolFocus is fully HIPAA compliant. We perform a full HIPAA audit every year with an independent third party, and we maintain all required HIPAA policies and staff training.
Annual third-party HIPAA audit and risk assessment with VanRein Compliance, our compliance partner since 2022. Each audit is completed and signed off, and any findings are tracked through remediation.
Regular check-ins with the VanRein team throughout the year, not just at audit time.
All required HIPAA policies, including security, staff responsibilities, incident response, and breach notification.
Annual HIPAA training for every WayCool team member.
A Business Associate Agreement (BAA) with your organization, and BAAs with the vendors we use that handle protected health information.
Technical safeguards: encryption in transit and at rest, multi-factor authentication, role-based access, audit logging, and tested backups. Each is described below.
You can also see our security overview at waycoolsw.com/security.
Your organization's part
WayCool secures the platform. Your organization decides who has access, what each user group can see, whether multi-factor authentication is required, and how staff handle client records. The settings in Security Settings at a Glance help you with that side.
Governance and policies
Annual full HIPAA audits and risk assessments conducted with our compliance partner, VanRein Compliance, since 2022.
Written policies covering staff responsibilities, security training, and incident response.
A Business Associate Agreement (BAA) that every organization can review, sign, and download for its own records.
Access control
Within our own company:
Multi-factor authentication is required on every internal system our team uses — cloud infrastructure, source control, email, and administrative tools.
Unique named accounts. We do not use shared logins.
Least-privilege access: staff have the access their role requires, and no more.
Within your organization's data, under your control:
Role-based permissions through user groups.
Record-level restrictions through data access rules, where your plan includes them.
Optional restriction of sign-ins to approved network locations.
Multi-factor authentication that any staff member can turn on, and that an administrator can require for everyone.
See Security Settings at a Glance for each of these.
Encryption and secrets
Data is encrypted in transit and at rest.
Credentials and keys are held in managed secret vaults — never in source code or configuration files.
Change management
All code is kept in version control.
Every change is reviewed and approved by another person before it reaches production.
Development, staging, and production run as separate environments.
Automated tests and checks must pass before any deployment.
We keep a durable record of what was deployed, when, and by whom.
Vulnerability management
Automated dependency scanning, so known vulnerable libraries are flagged as soon as they are published.
Regular patching of operating systems, runtimes, and frameworks.
Logging and monitoring
Centralized application and infrastructure logs with defined retention periods.
An audit trail of administrative actions — both ours and your own administrators'.
Alerting on errors, downtime, and suspicious activity such as repeated failed sign-ins.
A public status page at status.coolfocus.app.
Your administrators can review the security-relevant portion of this themselves — see Security Log and User Logs.
Backup and disaster recovery
Automated backups on a defined frequency and retention schedule.
Periodic test restores.
A business continuity plan developed with VanRein Compliance.
Maintaining recoverable backups is also a HIPAA requirement. For the full retention schedule — point-in-time, weekly, monthly, and yearly — and how the audit log is used to reconstruct changed data, see How WayCool Stores and Backs Up Your Data.
Vendor management
A published list of subprocessors — the vendors that may handle customer data while we provide the service.
Annual review of those vendors.
Business Associate Agreements in place with vendors that handle protected health information.
The subprocessor list is linked from Legal & Compliance Settings.
Customer-facing commitments
Terms of Service and Privacy Policy, both published and linked from Legal & Compliance settings.
A process for notifying customers of significant changes affecting their data.
A security contact for reporting a concern or a vulnerability.
If your board needs more detail
Security questionnaires, custom BAAs, Data Processing Agreements, audit documentation, and deeper review packets are all things we handle directly. Email [email protected] or open a conversation in Help — these requests are routed to our legal and security team rather than general support, and you will get a substantive answer rather than a form response.