Emburse Certify uses a variety of security technologies and procedures to help protect your personal information from unauthorized access, use, or disclosure. When you enter sensitive information (such as a credit card numbers) on our order forms, we encrypt the transmission of that information using secure socket layer technology (SSL). You are also required to use a password to securely access your account.
In May 2018, the EU General Data Protection Regulation (GDPR) will replace the existing 1995 EU Data Protection Directive (European Directive 95/46/EC).
Certify participates in and has certified its compliance with the EU-U.S. Privacy Shield Framework, and is committed to achieving GDPR compliance when the GDPR takes effect May 25, 2018. Certify’s Data Protection Officer and applicable legal, IT, Sales/Marketing and Support teams are in the process of ensuring our products, services, contracts and legal documents meet all GDPR requirements.
Certify is a Level 1 Compliant PCI Service Provider. Certify partners with ControlScan for quarterly and annual PCI compliance certification. ControlScan is a highly respected, trusted payment security and compliance firm. ControlScan is an Approved Scanning Vendor and a Qualified Security Assessor of the PCI Security Standards Council.
Certify has successfully completed its Service Organization Controls (SOC) Type 2 examination. The examination, conducted by independent accounting and auditing firm BerryDunn, evaluated the processes, procedures and controls for security, availability and confidentiality of Certify.
Certify participates in and has certified its compliance with the EU-U.S. Privacy Shield Framework and Swiss-U.S. Privacy Shield Framework. Certify is committed to subjecting all personal data received from European Union (EU) member countries, in reliance on the Privacy Shield Framework, to the Framework’s applicable Principles. This new framework replaced the U.S.-EU Safe Harbor Framework that was invalidated in October 2015. To learn more about the Privacy Shield Framework, visit the U.S. Department of Commerce’s Privacy Shield List.
Certify utilizes Amazon Web Services (AWS) for on-demand cloud computing to provide the most reliable and secure service available. AWS offers 210 security, compliance, and governance services and key features which is about 40 more than the next largest cloud provider. AWS also supports 89 security standards and compliance certifications including PCI-DSS, HIPAA/HITECH, FedRAMP, GDPR, FIPS 140-2, and NIST 800-171, which is meaningfully more than any other cloud provider. AWS offers encryption across 116 different AWS services which is 3x more than any major cloud provider.
Certify uses Symantec SSL certificates. Symantec’s Extended Validation SSL certificates are used for transport layer encryption throughout Certify. Our certificates use 2048-bit public keys, in compliance with the latest PCI DSS 3.1 requirements.
VeriSign’s weekly vulnerability assessment tests check Certify for known problems that impact security. We ensure every test returns zero critical findings and zero informational findings.
Certify partners with ControlScan for annual authenticated (gray box) web application assessment that includes penetration and vulnerability testing. All findings are reported, mitigated and validated.
Stay in compliance with the Sunshine Act automatically thanks to Certify. Interact with your colleagues in healthcare with confidence and peace of mind.