Protecting patient communications at every layer
Heron handles sensitive healthcare communications on behalf of clinics across Australia and New Zealand. We take a defence-in-depth approach to security — applying controls at the application, infrastructure, and organisational levels to protect the confidentiality, integrity, and availability of patient communications.
Heron Health Limited maintains a comprehensive set of security policies and procedures aligned to the SOC 2 Trust Service Criteria, covering everything from encryption and access control to incident response and business continuity.
Data Encryption
All data is encrypted at rest using Google Cloud KMS and in transit via TLS 1.2+ across all services.
Access Control
Role-based access with mandatory MFA via SSO.
Monitoring & Logging
Centralised logging with audit trails retained for one year. Authentication events, privilege changes, and data access are continuously monitored.
Incident Response
Documented response plan with severity-based classification (SEV-1 to SEV-4), tested annually.
Employee Security
Background checks for all hires, annual security awareness training, signed confidentiality agreements, and system access revoked within 24 hours of offboarding.
Business Continuity
Documented DR and BCP with RTO of 24 hours and RPO under 24 hours. Annual disaster recovery testing with validated restore procedures.
Certifications & frameworks
Heron's compliance programme is aligned to industry-recognised frameworks and independently audited.
SOC 2
Independent examination covering the Common Criteria (CC1–CC9) for the Security Trust Service Category.
Australian Privacy Act 1988
Compliant with the Australian Privacy Principles (APPs) governing the handling of personal information.
NZ Privacy Act 2020
Compliant with New Zealand's privacy framework and the Health Information Privacy Code 2020 governing collection, use, and disclosure of personal and health information.
HIPAA
Security and privacy controls aligned with HIPAA requirements for protecting health information.
How we protect your data
Patient communications are at the core of what we handle. Here's how we keep them safe.
Encryption
Data encrypted at rest using Google Cloud KMS with managed encryption keys. All data in transit protected via TLS 1.2+ with server-side encryption on cloud storage.
Data Residency
Heron's primary database and core data storage are in Australia, on Google Cloud Platform infrastructure. Heron's cloud provider maintains SOC 2 Type II, ISO 27001, ISO 27017, and ISO 27018 certifications.
AI & Third-Party Models
Patient communications are never used to train third-party AI models. All AI/ML providers are assessed via vendor risk assessment with contractual data protection obligations. Data minimisation principles are applied to all AI processing.
Data Classification
Three-tier data classification framework — Restricted, Internal, and Public — ensuring appropriate handling, access controls, and protection for patient health information and sensitive data.
Data Retention & Disposal
Defined retention schedules with automated lifecycle enforcement. Customer data deleted within 90 days of contract termination. Disposal procedures aligned with NIST 800-88 standards.
Sub-processors
A maintained list of sub-processors is available upon request. Contact us.
Infrastructure & operations
Enterprise-grade infrastructure with defence-in-depth security controls.
Cloud Hosting
Hosted on Google Cloud Platform using managed serverless services. GCP maintains SOC 2 Type II, ISO 27001, ISO 27017, ISO 27018, and PCI DSS certifications.
Network Security
No directly exposed servers — all ingress via managed services. GCP-managed firewall and routing, DDoS protection, and annual penetration testing by independent third parties.
System Hardening
Documented hardening standards for endpoints and cloud infrastructure. Full-disk encryption required on all devices, mandatory MFA, TLS 1.2+ enforced, and no hardcoded secrets.
Vulnerability Management
Continuous automated dependency scanning with defined remediation SLAs — Critical: 48 hours, High: 7 days. Weekly automated scanning complemented by static code analysis on all pull requests.
Backup & Recovery
Daily automated backups with 30–90 day retention and lifecycle-managed expiry. Restore procedures tested annually with validated recovery in under 2 hours against a 24-hour RTO target.
Business Continuity
Documented DR and BCP with RTO of 24 hours and RPO under 24 hours. Annual testing includes tabletop exercises and functional restore-from-backup validation. Distributed workforce model ensures operational resilience.
Documentation
Heron maintains a comprehensive library of security policies and compliance documents.
Privacy Policy (Australia)
How Heron handles personal information under the Australian Privacy Principles.
Privacy Policy (New Zealand)
How Heron handles personal information under the NZ Privacy Act 2020.
Terms & Conditions (Australia)
Terms governing use of Heron's platform for Australian clients.
Terms & Conditions (New Zealand)
Terms governing use of Heron's platform for New Zealand clients.
SOC 2 Report
Independent examination report covering Common Criteria CC1–CC9.
Data Processing Agreement (DPA)
Standard DPA template for customers requiring formal data processing terms.
Penetration Testing Statement
Summary of independent penetration testing scope, cadence, and approach.
Vendor Register & Sub-processor List
List of third-party vendors and sub-processors with classification and data access levels.
Frequently asked questions
Is Heron SOC 2 compliant?
Yes. Heron (Heron Health Limited) has completed a SOC 2 Type I examination covering the Common Criteria (CC1–CC9) under the Security Trust Service Category. The examination date is 10 March 2026. The full report is available upon request — contact your account manager or email support@heyheron.ai.
Where is my data stored?
Heron's primary database and core data storage are in Australia, on Google Cloud Platform infrastructure. GCP maintains SOC 2 Type II, ISO 27001, ISO 27017, and ISO 27018 certifications. Data is encrypted at rest using Google Cloud KMS and in transit via TLS 1.2+. For more detail, contact your account manager or email support@heyheron.ai.
Does Heron use third-party AI models? How is data handled?
Heron uses AI to power the service for patient communications. Patient communications are never used to train third-party AI models. All AI/ML providers undergo vendor risk assessment with contractual data protection obligations. Data minimisation principles are applied, and AI-related data is classified as Restricted under Heron's three-tier data classification framework.
Can I get a copy of your SOC 2 report?
Yes — the SOC 2 Type I report is available upon request. Please contact your account manager or email support@heyheron.ai and we'll share it with you.
How does Heron handle incident response?
Heron maintains a formal Incident Response Plan with severity-based classification (SEV-1 through SEV-4), defined response roles, and escalation procedures. During major incidents, stakeholders receive updates every 1–2 hours. The plan is tested annually through tabletop exercises — including simulated scenarios such as lost device response and compromised credentials — and a post-incident review is completed within 7 days of any incident.
What happens to my data if I cancel?
Upon cancellation, customer data is securely deleted within 90 days of contract termination. Heron maintains formal retention schedules — health data is retained for up to 90 days, and automated lifecycle rules enforce secure expiry of backups. Disposal procedures are aligned with NIST 800-88 standards. Financial records are retained for 7 years as required by law.
Does Heron support SSO / MFA?
Yes. Multi-factor authentication is mandatory for all Heron personnel via SSO with TOTP-based MFA. Clinic users authenticate via Firebase Auth, which also supports MFA. Heron enforces a minimum 12-character password policy with complexity requirements and account lockout after 6 failed attempts.
How often are penetration tests conducted?
Heron conducts external penetration testing annually, covering public endpoints, API surfaces, authentication flows, and voice infrastructure. Findings are remediated within defined SLAs (Critical: 48 hours, High: 7 days). In addition, continuous automated scanning and static code analysis run on all code changes. A penetration testing statement is available upon request.
How do I report a security vulnerability?
If you discover a security vulnerability, please report it responsibly by emailing support@heyheron.ai. We take all reports seriously and will respond promptly.