JLK, Inc. places the highest priority on the security of customer data and the protection of personal information. As an organization handling sensitive medical data, we maintain a systematic and transparent security management program aligned with SOC 2 and HIPAA standards.

Core Principles (SOC 2 Trust Services Criteria)

We perform audits and verifications based on three key pillars:

• Security: Technical and administrative safeguards to prevent unauthorized access and data leakage.
• Availability: Redundancy and disaster recovery measures to ensure continuous, uninterrupted service.
• Confidentiality: Strict access control policies ensuring only authorized personnel access sensitive information.

Note: JLK, Inc. strictly complies with HIPAA requirements for Protected Health Information (PHI), applying encryption, access controls, and audit logging at every stage of data transmission and storage.

Infrastructure Security & Reliability

JLK's service infrastructure is built on Amazon Web Services (AWS), operating within a globally proven, secure cloud environment.

1. VPC Isolation (Virtual Network Segmentation)

• All service components are isolated within AWS VPCs.
• Traffic between internal and external networks is strictly separated to block unauthorized access and control data flow.

2. Firewall & Security Group Rules

• Principle of Least Privilege: Security groups for application, database, and management networks permit only minimum required traffic.
• Defense Measures: AWS Network ACLs and security group rules are utilized to prevent unauthorized access, port scanning, and DDoS attempts.

3. High Availability & Redundancy

• Multi-AZ Deployment: Core services operate across multiple Availability Zones (AZs) with automatic failover.
• Disaster Recovery: Regular backups and recovery tests are performed to minimize data loss risk.

Data Security & Privacy

JLK manages all data, including medical information, in compliance with HIPAA and SOC 2 security controls.

Data Encryption

State	Method
In-Transit	Network traffic is protected using TLS 1.2+. Data traversing public networks is always encrypted.
At-Rest	Data is encrypted to AES-256 standards using AWS Key Management Service (KMS). Keys are managed separately.

Access Control & Authentication

• RBAC: System access is restricted by Role-Based Access Control following the principle of least privilege.
• MFA: Multi-Factor Authentication is mandatory for all internal user and administrator accounts.
• Audit Logging: Access events and authentication attempts are stored in a centralized system for real-time monitoring.

Privacy & PHI Protection

• HIPAA Compliance: All personal data and PHI are processed strictly per HIPAA Privacy and Security Rules.
• Audit Trails: Actions such as access, viewing, modification, and downloading are logged; anomalous activities trigger automated alerts.
• Data Residency: Data is stored in AWS regions within the United States, with protective measures for cross-border access.

Development Security & Testing

JLK proactively manages vulnerabilities through a rigorous testing framework.

• Pre-Release: All code is tested for security vulnerabilities prior to deployment.
• Routine Scans:
  • Application vulnerability assessments.
  • Network vulnerability assessments.
  • Security control framework reviews.
• Penetration Testing: External penetration testing is conducted annually.

Policies & Procedures

We maintain a comprehensive suite of security policies, reviewed and updated annually. Mandatory security training is required for all employees.

Key Policies Include:

• Asset Management
• Data Protection & Retention
• Information Security
• Incident Response
• Risk Assessment
• System Access Control
• Vendor & Vulnerability Management

Vulnerability Disclosure & Reporting

We value the security research community. Vulnerabilities affecting aiscan.medihub.ai, the AISCAN app, snappy-us.medihub.ai, the FASTRO app or other assets can be reported responsibly.

• How to Report: Via our Google Form.
• Requirements: Please include a detailed description and reproducible steps (or a working PoC).
• Process: Report → Verification → CSO Review → Risk Assessment → Response.

Appendix & Reference Links

• Policy Documents: Privacy Policy, Information Security Policy, Terms of Service.
• Compliance: HIPAA Business Associate Agreement, AWS Compliance Center, JLK Trust Center.
• Latest Status: November 2025 — Ongoing SOC 2 Type II audit.