Data encryption:  Sensitive data is protected by encryption, both in transit and at rest.

Data access controls: Sensitive data access is limited to those who need it only; access is logged and auditable. Granular data access (Related to roles)

Data backups: Regular data backups to protect against data loss due to hardware failure or other potential issues.

Data recovery: Plan in place for recovering data in the event of a disaster.

Regular security updates to keep the system and its components up to date with the latest security patches.

Compliance: The system complies with relevant industry standards and regulations, such as HIPAA and GDPR. It is noted that overall compliance will depend on the organization´s own data management processes. 

Data Governance: We have clear guidelines on data ownership, data retention policies and data classification.

Data privacy: We provide clear information to users about how their data will be used and protected.

Incident response: We follow strict protocols for responding to security incidents, including identifying and containing breaches, and reporting them to appropriate authorities.

Regular audit: Regular internal audit to ensure the system is compliant and detects any potential vulnerabilities. The last Pen-test conducted by an external IT security company was done in mid-2022.