Information Security Overview
Last Updated Date: October 15, 2025
SonoSim Inc. (“SonoSim, “we”, “our”, “us”) is committed to protecting the confidentiality, integrity, availability and security of all of its information systems and assets against new and existing cybersecurity threats. SonoSim and its management team expect all employees and users with access to SonoSim’s infrastructure and systems to continuously improve and maintain the security of company assets and customer data. This includes following a rigorous software development process, change management process, and maintaining a detailed incident response and disaster recovery plan.
TX-RAMP Certification 
SonoSim, Inc. has achieved Texas Risk and Authorization Management Program (TX-RAMP) Level 2 Certification, demonstrating that its information systems meet the State of Texas’ security and privacy requirements for handling confidential and regulated data.
Physical Security of SonoSim Information Systems
SonoSim servers are hosted on Amazon Web Services (AWS). AWS data centers are designed with security in mind and are ISO 27001 and FedRAMP/FISMA certified. AWS can provide reports for SOC 1, 2, and 3. AWS provides physical data center access only to approved employees who have a valid business justification. Access is restricted to specific areas, controlled at both perimeter and building ingress points by professional security staff utilizing CCTV systems and intrusion detection.
Learn more about AWS Physical security controls at:
https://aws.amazon.com/compliance/data-center/controls/
Network Security
SonoSim systems communicate using HTTPS and TLS protocols to secure data in transit. Network security is designed using least privilege principles and industry best practices. All access is logged and retained for a minimum of 90 days. Server access is limited to a selected group of authorized personnel based on roles and business needs and is continuously monitored.
Authentication
SonoSim uses Auth0 for identity access management. Auth0 is ISO27001, SOC 2 Type II, ISO 27018, HIPAA BAA, Gold CSA Start, and GDPR compliant. Authentication occurs only over secure HTTPS connections. Credentials are hashed and salted using the bcrypt algorithm, and all customer data stored at rest is encrypted with AES-256. Brute force protection, suspicious IP throttling, and breached password detection are enabled. Multi-Factor Authentication (MFA) is available to members using One-Time Passcodes (OTP) via authenticator apps.
Development Practices
SonoSim product development follows secure software development lifecycle practices. SonoSim managed systems are kept current with the latest security patches and monitored for suspicious activity. Development teams use continuous integration and deployment pipelines with automated and manual code reviews. Periodic internal scans and external third-party security assessments are performed annually to validate security posture.
Patch and Vulnerability Management
SonoSim follows a structured patch and vulnerability management process as part of its broader configuration and change management framework to maintain security and system integrity.
- SonoSimulator® Application: Updated every 1-2 months, with out-of-cycle patches for high or critical vulnerabilities.
- Web Applications: Updated continuously with daily to weekly releases.
- Security Patch Review: Findings from scans or assessments are reviewed within 48 hours. Critical vulnerabilities are remediated within 7 days; high-risk findings within 14 days.
- Testing Protocols: All patches undergo regression and functional testing in non-production environments before deployment.
All vulnerability findings and remediation activities are tracked through SonoSim’s Plan of Action and Milestones (POA&M) process in accordance with TX-RAMP Level 2 requirements.
Data Security & Privacy
SonoSim safeguards customer and personal data through encryption and strict access controls. Data is encrypted in transit using HTTPS and TLS 1.2, and is encrypted at rest using AES-256.
See SonoSim’s full policies at:
Compliance and Certifications
SonoSim’s information security program aligns with TX-RAMP Level 2 requirements and supporting frameworks such as NIST SP 800-53 Rev 5, the NIST Cybersecurity Framework, and CIS Critical Security Controls.
SonoSim also adheres to applicable privacy regulations, including the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and California Privacy Rights Act (CPRA).
SonoSim maintains:
- TX-RAMP Level 2 Certification
- ISO 9001:2015 Certification
- Annual independent third-party security assessments and penetration testing
- Semiannual internal audits and management reviews to validate control effectiveness and drive continuous improvement
Contacting Us
For security-related inquiries, contact:
security@sonosim.com.
This page is reviewed at least semiannually as part of SonoSim’s internal audit and TX-RAMP continuous monitoring process.