All customer data is hosted in AWS data centres which are certified SOC 2 Type 2 and represent the state-of-the-art in data security. Additionally, Ocean’s data is specifically stored at the Montreal data centre, ensuring local data residency for Canadians.

OceanMD has an established function responsible for Security and Privacy across the organization, in addition to advanced capabilities afforded by WELL Health Technologies, including: daily vulnerability scanning, quarterly org-wide risk analysis, annual penetration test and remediation, Threat Risk Assessments (TRA) every 2 years and both internal and external Privacy Impact Analyses.

ISO certifications are the international standard for good reason: They require continuous improvement, ongoing review, and active engagement with global industry best practices. As such, we are proud of our ISO 27001 certification which stands as a testament to our commitment to the security, confidentiality, and availability of our services.

This certification demonstrates Ocean’s commitment to continuously improving its information security posture amid a rapidly evolving landscape. You can request Ocean’s ISO certificate and/or relevant policies (verification required) at trust.oceanmd.com.

We have invested deeply in our security program, which is built on best practices and based on the models, policies, procedures, and standards of the International Organization for Standardization (ISO)/International Electronical Commission (IEC) 27001:2022 framework. ISO 27001 is a comprehensive security management standard that specifies a set of best practices and controls. It is an internationally recognized standard and means that, as an organization, OceanMD has:

• Examined our information security risks.
• Designed a set of security controls to mitigate these risks.
• Adopted a management process that reviews these controls on an ongoing basis.
• Conducted an internal audit of the above to test for conformity.
• Had an audit conducted by an ISO-accredited external party to test for conformity.

SOC 2 (System and Organization Controls 2) is a rigorous compliance framework that ensures a company follows strict standards for managing customer data securely. Achieving SOC 2 compliance demonstrates our commitment to data privacy, security, and operational excellence.