BostonGene Trust Center

BostonGene retains data for the duration of our services and in accordance with customer agreements, local laws and legislation (e.g., HIPAA).

The protection of our customers’ data is our top priority. In addition to our robust quality assurance program, we have an Information Management System (ISMS) program that supports our data security efforts. We have several policies in place under the ISMS to ensure the integrity and availability of the data that we process, including a Data Backup and Media Protection Policy and a Disaster Recovery Plan.

Backups of customer data are handled in accordance with customer agreements. Data stored on Amazon S3 is safeguarded by an exceptional data durability of 99.999999999% and availability of 99.99%.

BostonGene receives and processes all data in accordance with our Privacy Policy & Procedures. To ensure compliance with General Data Protection Regulation guidelines and to protect the privacy rights of data subjects, BostonGene solely processes de-identified data and confirms within our customer Data Processing Agreements that the exporter of the data has secured patient consent prior to data transfer.

Data in transit are encrypted using TLS 1.2 or better.

BostonGene data stored at AWS is encrypted using server-side encryption (SSE), which uses AES-256. As an additional safeguard, SSE-S3 encrypts the key itself with a root key that it regularly rotates. SSE-S3 uses one of the strongest block ciphers available.

BostonGene employees also use hardened laptops that are encrypted.

Access to customer accounts and data follows the Least Privilege Principle. The Analytical Project Manager requests access for a project to which they are assigned, specifying permissions that are required according to the Statement of Work and contract. The IT Department grants access to the required data after approval according to internal policies. Access is restricted to the project team and limited to necessary tasks. Role-based controls enforce restrictions, with regular audits ensuring compliance. Access to the data is revoked when it is no longer needed to fulfill project deliverables.

BostonGene has an internal security organization that is responsible for managing security in alignment with the company's policies and procedures, which are reviewed periodically (and at least annually). Several policies are used as guidance for managing access and security, including but not limited to: “Information Security Management Policy,” “Acceptable Use Policy,” and “Logical Access Control Policy.”

BostonGene uses enterprise tools, including Security Information and Event Management (SIEM) and Extended Detection and Response (XDR) solutions to monitor and analyze security events from various sources, including network devices, cloud solutions, and endpoints. The Security Operations Center is immediately notified of alerts to ensure a prompt response to potential security threats.

BostonGene has documented security incident response policies and procedures that are tested routinely as needed and at least annually.

BostonGene’s Security Incident Management Policy outlines the processes for expeditiously reporting a security breach.

Routine security awareness training is provided to employees in several formats, including monthly general security awareness training and annual corporate security training. Training topics include, but are not limited to, general security best practices, information classification & handling, privacy regulations, insider threat, and phishing concepts.

BostonGene limits its use of third-party vendors unless it is required to provide services to our customers. All vendors, including sub-processors, are specified in data processing agreements with our customers.

BostonGene maintains a Know Your Third Party (KYTP) program to onboard new vendors that may impact the security of our services. Periodic vendor assessments and/or compliance report reviews are conducted based on our Vendor Management Policy.