Security Assurance Plan

The Security Assurance Plan (SAP) sets out the framework of requirements that Cure51 imposes on itself and extends to its critical service providers, notably its hosting provider, Amazon Web Services (AWS). In order to guarantee a consistent level of protection, an annual review is carried out to ensure that contractual commitments are fully aligned with the operational security measures observed.

1. NORMS AND CERTIFICATIONS

To ensure the highest standards of security in data management, Cure51 is committed to complying with the most strict data protection standards:

• ISO/IEC 27001:2022;

• Health Data Hosting (HDS), v2.0, April 2024.
  
  

2. CURE51 SCOPE 

Managed hosting provider. Cure51 provides a comprehensive managed hosting service.  Cure51’s Information Security Management System (ISMS) encompasses all resources (human, technical and organisational) dedicated to the design, development, operation and support of applications.

Scope of HDS certification. Cure51’s hosting infrastructure is based on an architecture structured around the five layers defined by the Agence du numérique en santé (ANS) framework.

Physical infrastructure (outsourced to AWS). Cure51 draws on the expertise of AWS, which ensures compliance of the first two layers of infrastructure. AWS’s HDS certification is available on request.

• Activity 1: the provision and maintenance of physical sites to host the hardware infrastructure of the information system used for processing personal health data (DSCP);

• Activity 2: the provision and maintenance of the hardware infrastructure of the information system used for processing personal health data (DSCP).

Services and Operations (provided by Cure51). Cure51 directly manages layers 3 to 5, ensuring the security and availability of the information system (IS) dedicated to personal health data (PHD):

• Activity 3: provision and maintenance of the virtual infrastructure of the IS used for processing PHD;

• Activity 4: provision and maintenance of the IS application hosting platform to ensure it remains in operational condition;

• Activity 5: administration and operation of the IS containing PHD.

3. DATA PROTECTION AND STORAGE – REPRESENTATION OF GUARANTEES

Cure51 is committed to ensuring the highest level of security, confidentiality and data sovereignty for all the health data it processes. It sets out the roles, the organisation of its infrastructure and all the technical and organisational safeguards applied as follows:

3.1 Secure Development 

3.2 Data location and sovereignty 

All data hosted by Cure51 is stored exclusively within the European Economic Area (EEA), in highly secure data centers located in:

• France: Paris region (eu-west-3);

• Germany: Frankfurt region (eu-central-1);

• No data is stored outside the EEA.

3.3 Access and operations Management

No administrative, maintenance, or support operations involve remote access to data from a third country outside the EEA. All technical interventions are performed by authorized personnel operating from within the European Union (EU).

3.4 Protection against unauthorized access and security measures

To eliminate any risk of unauthorized access and ensure full compliance with non-European regulations that may apply to infrastructure providers, Cure51 implements the following security measures:

• Systematic encryption: all data is encrypted at rest (AES-256) and in transit (TLS 1.3);

• Exclusive control over encryption keys: encryption keys are generated, managed, and stored under the exclusive control of Cure51 within the EEA. The hosting infrastructure provider (AWS) has no access to the decryption keys;

• Data is unusable: in the event of an access request made to the hosting infrastructure, the data stored in encrypted form remains technically unusable and indecipherable without the keys held by Cure51;

• Strict access control: logical access rights for application and system administration are strictly reserved for authorized Cure51 collaborators.

4. COMPLEMENTARY SECURITY MEASURES 

CURE51 maintains and manages the protection of PHD within its applications at all stages of their lifecycle. 

4.1 Secure Development 

Agile methodology, code reviews, and testing. All development activities are organized using Agile methods (Scrum, Kanban, etc.). Developers perform unit tests, functional integration tests, and end-to-end tests. The code undergoes peer review prior to deployment.

Vulnerability management. An automated vulnerability check for the libraries used is implemented during integration, allowing for blocking in the event a high-severity vulnerability (CVSS ≥ 7) is detected.

Software Quality Assurance. Quality Assurance (QA) tests all applications before they go into production (manual and automated tests).

Separation of the Client’s test environments and data. The Client’s development and test environments are logically separated from the production environment. No DSCP is used in the Client’s development or test environments.

Automated code testing. The code is automatically tested using predefined test scenarios to ensure that changes do not result in any loss or degradation of security.

Third-Party penetration testing. In addition to its ongoing vulnerability management program (internal scans and tests), Cure51 regularly engages independent cybersecurity experts to conduct penetration tests. This third-party approach ensures an objective and comprehensive assessment of the infrastructure’s robustness.

4.2 Authentication security

Password policy. Cure51 enforces a rigorous password policy, with complexity and length requirements aligned with international standards for security. This configuration ensures optimal protection against brute-force attacks. Cure51 uses a secure password manager.

Two-factor authentication. Access to applications handling DSCPs is strictly contingent upon the use of multi-factor authentication (MFA). This measure serves as a critical security barrier against identity theft and the compromise of user accounts.

Role-based access controls. Cure51 applications are subject to role-based access controls. This mechanism enables strict segregation of duties, ensuring that access to DSCPs is limited solely to duly authorized profiles in accordance with the principle of least privilege.

4.3 Securing data in transit

All data traffic passing through public networks is protected by encryption protocols that comply with the latest industry standards. Cure51 requires the use of the HTTPS/TLS protocol with a minimum version of TLS 1.2, thereby prohibiting the use of obsolete or vulnerable cryptographic suites.

4.4 Change management

Cure51 has defined a change management procedure that includes:

A description of the change;

• A risk analysis related to security or the protection of DSCPs;

• The impact on the Business Continuity Plan / Disaster Recovery Plan (BCP/DRP);

• Planning and implementation of the change;

• A post-implementation review.

4.5 Security 

Physical Infrastructure. Cure51 uses servers provided by AWS in data centers located in Europe. No DSCP is transferred or stored outside the European Economic Area (EEA). To ensure continuous operation (24/7) and constant service availability, AWS data centers are equipped with redundant power systems and are subject to environmental controls. AWS is HDS and ISO/IEC 27001:2022 certified.

Protection Measures. Cure51 implements a multi-layered defense strategy based on state-of-the-art security solutions. The network is protected by a set of complementary technical measures:

• Traffic control: network segmentation, firewalls, and strict access control lists;

• Data integrity: systematic encryption of traffic via the TLS protocol;

• Host security: deployment of anti-malware solutions and use of bastion hosts for secure administration.

Security and high availability architecture. The network architecture is designed according to the principle of defense in depth, structured into several tightly sealed layers of security:

• Redundancy and resilience: each application and security layer is replicated across multiple Availability Zones (AZs) to ensure service continuity;

• Service isolation: exposure to the public network is limited and controlled, with each layer of the architecture protected by dedicated firewalls that ensure airtight compartmentalization.

Logical access management and traceability. Access control to sensitive environments is based on a policy of maximum restriction:

• Administrative privileges: access to the production infrastructure is restricted exclusively to duly authorized system administrators, in accordance with the principle of least privilege;

• Auditability of DSCPs: any access to or manipulation of DSCPs is subject to rigorous monitoring and systematic logging. These event logs are stored in secure environments and protected against any tampering.

4.6 Backups 

Cure51 has implemented a backup policy across all production systems and environments. This policy covers both application data (databases, S3 buckets) and technical configurations, via Git repositories. In accordance with security requirements, these backups are encrypted before being transferred to secure storage areas and are made immutable to prevent any malicious alteration or deletion. Restoration procedures and tests are performed periodically based on the criticality level of the resources involved. Access to backups is strictly limited to duly authorized system administrators, thereby ensuring maximum protection against unauthorized access. Backups are immutable.

4.7 Event logs 

Cure51 has implemented an event logging policy using system administration logs. Activities across all Cure51 applications are also logged.

4.8 Security incident management 

A continuous alert system enables constant monitoring of security incidents and ensures that system administrators resolve them as quickly as possible. Collaborators are trained on security incident response processes, including the management of communication channels and escalation paths.

4.9 Encryption 

Encryption of stored data. Cure51 uses low-level disk encryption. The encryption has a strength of at least AES-256 or equivalent. Encryption keys are managed through a dedicated key management service (KMS), with strict segregation of administrative privileges. The key lifecycle (generation, rotation, revocation) is documented.

Communication Encryption. On public networks, all communications with Cure51 user interfaces and APIs are encrypted using the HTTPS/TLS standard (TLS 1.2 or higher). This ensures that all traffic between Cure51 and users and partners is secure in transit.

Backups. All backups are encrypted before being transferred to a remote storage location.

4.10 Availability and Continuity Plan 

Redundancy. The entire infrastructure is redundant to minimize the risk of downtime and data loss. Databases are configured with near-instantaneous replication to ensure that, under normal operating conditions, the complete loss of the primary node receiving writes results in no more than a few seconds of data loss.

Service level agreement. Cure51 guarantees a monthly availability rate of ninety-nine percent (99%), excluding scheduled maintenance. Compliance with these commitments (SLA) is subject to a monthly audit based on AWS health reports, which are systematically sent to the customer. In addition to technical availability, the monthly review includes an analysis of compliance with contractual terms, the responsiveness of AWS support, and an analysis of third-party security reports.

Recovery point objective. Cure51’s data backup policy commits to daily backups of production databases. 

Disaster recovery plan. The disaster recovery plan ensures that the production platform can be fully restored in the event of a total failure of the production environment. All code and configurations are stored in secure locations and are independent of the production environment.

4.11 Organisational security 

CISO. A Chief Information Security Officer (CISO) is appointed. The CISO assists in managing the ISMS, handles security incidents, and reports directly to senior management.

Training. Staff who process DSCP undergo regular background checks and receive ongoing training on how to mitigate risks associated with the processing of personal data.

Background and Skills Screening. Cure51 conducts background checks on all new collaborators. These checks are also performed for service providers. Background checks may include verification of technical and general skills, as well as previous employment history.

Confidentiality agreement. All collaborators must sign non-disclosure and confidentiality agreements. This confidentiality agreement remains in effect after the employment contract ends.

Definition of roles and responsibilities. Cure51 ensures that all roles and responsibilities are clearly defined and understood by the individuals to whom they are assigned.

Disciplinary procedure. Cure51 has established disciplinary procedures in the event of a breach, as provided for in the internal regulations.

Security Awareness. 

• All collaborators complete a security awareness training program that is part of the onboarding process and is reviewed annually thereafter. Basic rules and best practices are also regularly reinforced at Cure51’s offices;

• All developers are trained in best practices for software development;

• The security team also provides additional security awareness updates via email, articles, and presentations at internal events.
  
  
  Audits. Cure51 is committed to a cycle of continuous improvement and to regularly auditing its systems:

• Internal audit plan: all processes are audited by internal audit teams or external service providers;

• Management review: management reviews ensure that leadership systematically reviews the ISMS, evaluates opportunities for improvement, and decides on the necessary measures to ensure the relevance, adequacy, and effectiveness of the ISMS;

• Technical audits: in addition to vulnerability management, which includes analysis and testing, Cure51 employs third-party security experts to conduct detailed penetration tests. These external technical audits are incorporated into Cure51’s annual audit plan;

• Compliance certification audit: Cure51 has undertaken a certification process with an accredited body to ensure that its ISMS complies with internationally recognized industry standards. The proper functioning of the ISMS is therefore assessed annually by an independent, trusted third party.

  
  

4.12 Reversibility and end of service 

Upon termination of the contract, Cure51 will return all of the Client’s DSCPs within ninety (90) business days, while ensuring uninterrupted access during this transition. In accordance with HDS standards and the General Data Protection Regulation (GDPR), this portability is carried out using open and structured formats (JSON, CSV, XML) and interoperability standards such as HL7 FHIR to preserve the semantic integrity of the information. Security, including encryption and logging, is rigorously maintained until the final transfer. Once the transfer has been validated, Cure51 irreversibly deletes the data from all of its infrastructure and provides the Client with a formal certificate of destruction, attesting that no copies are retained by its services or subcontractors.