Security & Data Protection
Where We Store Data
Infrastructure, encryption, network protection, backup and recovery.
Protecting personal and sensitive data is critical for our mental health screening platform used in schools, universities, and other organizations. Our platform runs on DigitalOcean's secure infrastructure and compliance-ready services, which lets us maintain strong security standards, high availability, and alignment with US regulatory expectations — in particular HIPAA.
🔒 Infrastructure security
- Certified data centers — all DigitalOcean data centers meet Tier III or higher standards, with 24/7 monitoring, biometric access controls, and fully redundant power and network systems.
- US availability — multiple US-based data centers let us store data close to users, keep performance high, and comply with US regulations including HIPAA.
- DigitalOcean's certifications — SOC 2 Type II, ISO/IEC 27001 and PCI-DSS, held by DigitalOcean for the infrastructure we run on.
🔑 Encryption
At rest
- Managed databases: LUKS with AES-XTS-PLAIN64 (512-bit key), integrity protected via HMAC-SHA256.
- Object storage: AES-256-XTS full-disk encryption.
- Backups: AES-256 in CTR mode with RSA-protected keys.
In transit
- All connections use TLS 1.2 and TLS 1.3 to protect data during transmission.
- HTTPS and SSL/TLS ensure secure communications between services.
🌐 Network protection
- Virtual Private Cloud (VPC) — fully isolated private networks, inaccessible from the public internet.
- Private networking — internal server-to-server communication runs over a private interface, keeping sensitive traffic off the public internet.
- Cloud firewalls — stateful, network-based firewalls give precise inbound and outbound control by IP, port and protocol.
- DDoS protection — always-on mitigation against network-layer attacks without latency impact.
👥 Access to the infrastructure
- Role-based access control — access to the DigitalOcean account is granted by role, carrying only the permissions the job needs.
- Two-factor authentication — required on every account that can reach the infrastructure.
- Audit logs — infrastructure activity is tracked, including resource creation and deletion and API token use.
📊 Data and application security
- Managed databases and caching run with automatic security updates and patches applied.
- Automated backups and snapshots support quick disaster recovery.
- Monitoring and alerting detect anomalies in CPU, memory and network traffic.
💾 Backup and recovery
Automated backup runs through incremental snapshots, enabling full database recovery down to the minute. This nearly eliminates the risk of data loss, providing continuous protection and instant rollback in case of system failure or unexpected issues.
- A second validated copy of all data is kept in DigitalOcean Spaces and checked after every update.
- Screening data, system access logs, API request logs, credentials and login history are retained for six years, then securely deleted.
📜 Compliance and regulatory alignment
MARS itself is not separately certified under SOC 2, ISO 27001 or PCI-DSS. Those certifications belong to DigitalOcean and cover the infrastructure the platform runs on. What MARS holds directly is a signed Business Associate Agreement with DigitalOcean, and compliance with the laws that govern student and health data — FERPA, HIPAA, COPPA and CSPC.
- HIPAA — we hold a signed Business Associate Agreement with DigitalOcean covering PHI on approved products.
- SOC 2 Type II, ISO/IEC 27001, PCI-DSS — these are DigitalOcean's certifications, covering the infrastructure layer. They are not certifications of MARS.
✅ How this supports our platform
- Protecting data — encryption at rest and in transit, private VPC networks, strict identity and role-based access controls.
- Securing screening results — HTTPS with TLS 1.3 ensures confidential access.
- Reducing breach risk — firewalls, private networking and role separation prevent unauthorized access.
- Compliance readiness — running on certified infrastructure, plus our signed BAA, supports our HIPAA obligations. The underlying certifications remain DigitalOcean's.
- Reliability and resilience — automated backups and disaster recovery protect sensitive records from loss.
📂 Documentation available on request
- DigitalOcean SOC 2 Type II report
- DigitalOcean ISO/IEC 27001 certificate
- DigitalOcean PCI-DSS attestation of compliance
- DigitalOcean Data Processing Agreement (DPA)
- Our signed Business Associate Agreement (BAA) with DigitalOcean, for HIPAA
DigitalOcean is more than a hosting provider. It is a secure infrastructure platform that lets our screening platform handle sensitive data safely — through encryption, private networking, access control and compliance-ready documentation.
Did this answer your question?
😞
😐
🤩