> ## Documentation Index
> Fetch the complete documentation index at: https://www.aptible.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Security & Compliance - Overview

> Learn how Aptible enables dev teams to meet regulatory compliance requirements (HIPAA, HITRUST, SOC 2, PCI) and pass security audits

# Overview

[Our story](https://www.aptible.com/docs/getting-started/introduction.md#our-story) began with a strong focus on security and compliance, making us the leading Platform as a Service (PaaS) for security and compliance.

We provide developer-friendly infrastructure guardrails and solutions to help our customers navigate security audits and achieve compliance. This includes:

* **Security best practices, out-of-the-box**: When you provision a [dedicated stack](https://www.aptible.com/docs/core-concepts/architecture/stacks.md), you automatically unlock a [suite of security features](https://www.aptible.com/secured-by-aptible), including encryption, [DDoS protection](https://www.aptible.com/docs/core-concepts/security-compliance/ddos-pid-limits.md), host hardening, and [intrusion detection](https://www.aptible.com/docs/core-concepts/security-compliance/hids.md), alleviating the need to worry about security best practices.
* **Security and Compliance Dashboard**: The [Security & Compliance Dashboard](https://www.aptible.com/docs/core-concepts/security-compliance/security-compliance-dashboard/overview.md) provides a unified view of the implemented security controls —  track progress, achieve compliance, and easily generate summarized reports.
* **Access control**: Secure access to your resources is ensured with [granular user permission](https://www.aptible.com/docs/core-concepts/security-compliance/access-permissions.md) controls, [Multi-Factor Authentication (MFA)](https://www.aptible.com/docs/core-concepts/security-compliance/authentication/password-authentication.md#2-factor-authentication-2fa), and [Single Sign-On (SSO)](https://www.aptible.com/docs/core-concepts/security-compliance/authentication/sso.md) support.
* **Red Team Reviews (early access)**: [Red Team Reviews](https://www.aptible.com/docs/core-concepts/security-compliance/red-team-reviews.md) examine the apps an organization runs on Aptible for exploitable security problems. During early access, Aptible's security team reviews every report before delivery. Available on request.
* **Compliance made easy**: We provide HIPAA Business Associate Agreements (BAAs), HITRUST Inheritance, and streamlined SOC 2 compliance solutions — CISO-approved.

# Learn more about security functionality

> [card] [Authentication](https://www.aptible.com/docs/authenticating-with-aptible)
>
> Learn about password authentication, SCIM, SSH keys, and Single Sign-On (SSO)

> [card] [Roles & Permissions](https://www.aptible.com/docs/access-permissions.md)
>
> Learn to managr roles & permissions

> [card] [Security & Compliance Dashboard](https://www.aptible.com/docs/intro-compliance-dashboard.md)
>
> Learn to review, manage, and showcase your security & compliance controls

> [card] [DDoS Protection](https://www.aptible.com/docs/pid-limits.md)
>
> Learn about Aptible's DDoS Protection

> [card] [Managed Host Intrusion Detection (HIDS)](https://www.aptible.com/docs/hids.md)
>
> Learn about Aptible's methodoloy and process for intrusion detection

> [card] [Image and Vulnerability Scanning](https://www.aptible.com/docs/how-to-guides/platform-guides/image-vulnerability-scanning.md)
>
> Lint Dockerfiles and scan images in CI/CD before deploy, and keep scanning between releases

> [card] [Red Team Reviews (Early Access)](https://www.aptible.com/docs/core-concepts/security-compliance/red-team-reviews.md)
>
> Learn how Aptible scans your apps for exploitable security problems

# FAQ

> [accordion] How do I achieve HIPAA compliance with Aptible?
>
> ## Read the guide
>
> > [card] [How to achieve HIPAA compliance](https://www.aptible.com/docs/achieve-hipaa.md)

> [accordion] How do I achieve HITRUST compliance with Aptible?
>
> ## Read the guide
>
> > [card] [How to navigate HITRUST Certification](https://www.aptible.com/docs/requesting-hitrust-inheritance.md)

> [accordion] How should I navigate security questionnaires and audits?
>
> ## Read the guide
>
> > [card] [How to navigate security questionnaires and audits](https://www.aptible.com/docs/security-questionnaires.md)

> [accordion] Does Aptible provide anti-virus/anti-malware/anti-spyware software?
>
> Aptible does not currently run antivirus on our platform; this is because the Aptible infrastructure does not run email clients or web browsers, which are by far the most common vector for virus infection. We do however run Host Intrusion Detection Software (HIDS 12) which scans for malware on container hosts. Additionally, our security program does mandate that we run antivirus on Aptible employee workstations and laptops.

> [accordion] How do I access SOC 2 reports and other security documentation?
>
> Aptible maintains compliance with programs and frameworks including SOC 2 Type II, GDPR, HIPAA, PCI, HITRUST, EU-US Data Privacy Framework, PIPEDA, Swiss-US Data Privacy Framework, and the UK Extension to the EU-US Data Privacy Framework.
>
> We provide documents attesting to our ongoing compliance for use as evidence in your organization's compliance process. Access is provided through [trust.aptible.com](https://trust.aptible.com/). Use **Request or Regain Access** with the email address associated with your Aptible account.
>
> Aptible requires the intended consumer of confidential reports to have an NDA in place directly with Aptible. Through the trust portal, you can e-sign the mutual NDA and access documents such as:
>
> * HITRUST Engagement Letter
> * HITRUST CSF Letter of Certification
> * HITRUST NIST CSF Assessment
> * HITRUST CSF Validated Assessment Report
> * SOC 2 Type 2 Report
> * SOC 2 Continued Operations Letter
> * Penetration Test Summary
>
> If you have trouble accessing the portal or need special assistance, contact [Aptible Support](https://www.aptible.com/docs/how-to-guides/troubleshooting/aptible-support.md).