Security
Security is key when selecting an application service provider dealing with sensitive healthcare data.
SMAIO Systems security measures address all the different aspects of our computing environment.

Security at SMAIO's development team level
Our security SOP cover physical and logical security of the organization's facility, assets, electronic data stored in desktop/laptop computers, from unauthorized access or misuse.

Data center security
Sensitive data are stored by two leading providers of managing health related data hosting services.
  • For the US
  • For the rest of the world hébergeur agréé par le ministère de la santé

  • Both are certified ISO 27001.


    Data Transmission Security
    Data sent over the Internet during a browser session is encrypted using Transport Layer Security (TLS 1.2) with a 128-bit certificate provided by Global Sign.

    Application Authentication
    KEOPS uses individual login/password combinations to authenticate a user (minimum of 8 characters including figures / letters and special characters). Once a secure web session has begun, the client is immediately prompted for their application ID and password. 5 consecutive failures to supply valid responses will deny the client access to the KEOPS application and block user's IP. Passwords are automatically changed every 6 months. Additionally, clients are granted with a security file allowing them to see patient identity whereas it is encrypted in the server using AES 128 bits algorithm.

    Application Security
    Application security utilizes a role-based scheme based on the combination of permissions determined by an individual login identifier and password through 4 distinct user profiles. Access to patient identity as well as individual read/write/functionality permissions can be granted based on a user's login ID and sharing lists defined by patient files owners.
    Audit trails record any modification / suppression performed in the database while identifying the author.

    Data Backups
    Production servers are backed up on a nightly basis. Client data is encrypted and backed up to tape media in addition to it being backed up to a secure offsite location nightly. Backup tapes and disks are securely destroyed when their useful life expires.

    Users code of conduct
    Users are invited to adopt a code of conduct to ensure maximum level of security while using KEOPS. This includes no sharing of authentication information as well as systematic log off at the end of each KEOPS session.