Security at Heron

Heron is built to handle sensitive patient communications. Security, privacy, and compliance are foundational to everything we do.

SOC 2 (In Progress) Encrypted at Rest & In Transit RTO < 24 Hours

Protecting patient communications at every layer

Heron handles sensitive healthcare communications on behalf of clinics across Australia and New Zealand. We take a defence-in-depth approach to security — applying controls at the application, infrastructure, and organisational levels to protect the confidentiality, integrity, and availability of patient communications.


Heron Health Limited maintains a comprehensive set of security policies and procedures aligned to the SOC 2 Trust Service Criteria, covering everything from encryption and access control to incident response and business continuity.

Data Encryption

All data is encrypted at rest using Google Cloud KMS and in transit via TLS 1.2+ across all services.

Access Control

Role-based access with mandatory MFA via SSO.

Monitoring & Logging

Centralised logging with audit trails retained for one year. Authentication events, privilege changes, and data access are continuously monitored.

Incident Response

Documented response plan with severity-based classification (SEV-1 to SEV-4), tested annually.

Employee Security

Background checks for all hires, annual security awareness training, signed confidentiality agreements, and system access revoked within 24 hours of offboarding.

Business Continuity

Documented DR and BCP with RTO of 24 hours and RPO under 24 hours. Annual disaster recovery testing with validated restore procedures.

Certifications & frameworks

Heron's compliance programme is aligned to industry-recognised frameworks and independently audited.

Underway

SOC 2

Independent examination covering the Common Criteria (CC1–CC9) for the Security Trust Service Category.

Examination date: 2 March 2026
Active

Australian Privacy Act 1988

Compliant with the Australian Privacy Principles (APPs) governing the handling of personal information.

Privacy Policy maintained & published
Active

NZ Privacy Act 2020

Compliant with New Zealand's privacy framework and the Health Information Privacy Code 2020 governing collection, use, and disclosure of personal and health information.

Privacy Policy maintained & published

How we protect your data

Patient communications are at the core of what we handle. Here's how we keep them safe.

Encryption

Data encrypted at rest using Google Cloud KMS with managed encryption keys. All data in transit protected via TLS 1.2+ with server-side encryption on cloud storage.

Data Residency

All patient communications are hosted on Google Cloud Platform infrastructure. Heron's cloud provider maintains SOC 2 Type II, ISO 27001, ISO 27017, and ISO 27018 certifications.

AI & Third-Party Models

Patient communications are never used to train third-party AI models. All AI/ML providers are assessed via vendor risk assessment with contractual data protection obligations. Data minimisation principles are applied to all AI processing.

Data Classification

Three-tier data classification framework — Restricted, Internal, and Public — ensuring appropriate handling, access controls, and protection for patient health information and sensitive data.

Data Retention & Disposal

Defined retention schedules with automated lifecycle enforcement. Customer data deleted within 90 days of contract termination. Disposal procedures aligned with NIST 800-88 standards.

Sub-processors

A maintained list of sub-processors is available upon request. Contact us.

Infrastructure & operations

Enterprise-grade infrastructure with defence-in-depth security controls.

Cloud Hosting

Hosted on Google Cloud Platform using managed serverless services. GCP maintains SOC 2 Type II, ISO 27001, ISO 27017, ISO 27018, and PCI DSS certifications.

Network Security

No directly exposed servers — all ingress via managed services. GCP-managed firewall and routing, DDoS protection, and annual penetration testing by independent third parties.

System Hardening

Documented hardening standards for endpoints and cloud infrastructure. Full-disk encryption required on all devices, mandatory MFA, TLS 1.2+ enforced, and no hardcoded secrets.

Vulnerability Management

Continuous automated dependency scanning with defined remediation SLAs — Critical: 48 hours, High: 7 days. Weekly automated scanning complemented by static code analysis on all pull requests.

Backup & Recovery

Daily automated backups with 30–90 day retention and lifecycle-managed expiry. Restore procedures tested annually with validated recovery in under 2 hours against a 24-hour RTO target.

Business Continuity

Documented DR and BCP with RTO of 24 hours and RPO under 24 hours. Annual testing includes tabletop exercises and functional restore-from-backup validation. Distributed workforce model ensures operational resilience.

Documentation

Heron maintains a comprehensive library of security policies and compliance documents.

Privacy Policy (Australia)

How Heron handles personal information under the Australian Privacy Principles.

Privacy Policy (New Zealand)

How Heron handles personal information under the NZ Privacy Act 2020.

Terms of Service

Heron's terms of service governing use of the platform.

SOC 2 Report In Progress

Independent examination report covering Common Criteria CC1–CC9.

Data Processing Agreement (DPA)

Standard DPA template for customers requiring formal data processing terms.

Penetration Testing Statement In Progress

Summary of independent penetration testing scope, cadence, and approach.

Vendor Register & Sub-processor List

List of third-party vendors and sub-processors with classification and data access levels.

Frequently asked questions

Yes. Heron (Heron Health Limited) has completed a SOC 2 Type I examination covering the Common Criteria (CC1–CC9) under the Security Trust Service Category. The examination date is 2 March 2026. The full report is available upon request — contact your account manager or email support@heyheron.ai.
All patient communications are hosted on Google Cloud Platform infrastructure. GCP maintains SOC 2 Type II, ISO 27001, ISO 27017, and ISO 27018 certifications. Data is encrypted at rest using Google Cloud KMS and in transit via TLS 1.2+. For specific region details, contact your account manager or email support@heyheron.ai.
Heron uses AI to power the service for patient communications. Patient communications are never used to train third-party AI models. All AI/ML providers undergo vendor risk assessment with contractual data protection obligations. Data minimisation principles are applied, and AI-related data is classified as Restricted under Heron's three-tier data classification framework.
Yes — the SOC 2 Type I report is available upon request. Please contact your account manager or email support@heyheron.ai and we'll share it with you.
Heron maintains a formal Incident Response Plan with severity-based classification (SEV-1 through SEV-4), defined response roles, and escalation procedures. During major incidents, stakeholders receive updates every 1–2 hours. The plan is tested annually through tabletop exercises — including simulated scenarios such as lost device response and compromised credentials — and a post-incident review is completed within 7 days of any incident.
Upon cancellation, customer data is securely deleted within 90 days of contract termination. Heron maintains formal retention schedules — health data is retained for up to 90 days, and automated lifecycle rules enforce secure expiry of backups. Disposal procedures are aligned with NIST 800-88 standards. Financial records are retained for 7 years as required by law.
Yes. Multi-factor authentication is mandatory for all Heron personnel via SSO with TOTP-based MFA. Clinic users authenticate via Firebase Auth, which also supports MFA. Heron enforces a minimum 12-character password policy with complexity requirements and account lockout after 6 failed attempts.
Heron conducts external penetration testing annually, covering public endpoints, API surfaces, authentication flows, and voice infrastructure. Findings are remediated within defined SLAs (Critical: 48 hours, High: 7 days). In addition, continuous automated scanning and static code analysis run on all code changes. A penetration testing statement is available upon request.
If you discover a security vulnerability, please report it responsibly by emailing support@heyheron.ai. We take all reports seriously and will respond promptly.

Have a security question?

Our team is ready to help with security reviews, compliance documentation, and any
questions about how we protect your data.

Contact Security