Enterprise Security & Compliance
Colibri is engineered from the ground up to satisfy the world's most demanding financial, clinical, and critical infrastructure data protection standards.
SOC 2 Type II & ISO 27001:2022
Colibri undergoes annual independent audits by top-tier AICPA-accredited accounting firms, evaluating security, availability, and confidential data processing integrity.
Audited Standards & Certifications
- SOC 2 Type II (Security & Confidentiality)
- ISO/IEC 27001:2022 ISMS Certified
- Continuous automated evidence collection
Technical Controls & Enforcement
- Automated continuous control validation tests re-run every 60 seconds
- Independent third-party network and application penetration tests bi-annually
- Formal vendor risk management and supply-chain dependency scanning
Single-Tenant Dedicated VPC Deployments
For organizations with strict air-gapped data residency mandates, Colibri provisions single-tenant clusters in customer-owned AWS, GCP, or Azure Virtual Private Clouds.
Audited Standards & Certifications
- Zero multi-tenant cross-talk
- Dedicated database & compute enclaves
- Direct AWS Direct Connect / Azure ExpressRoute
Technical Controls & Enforcement
- Dedicated KMS keys owned and managed directly by the customer
- Hardware-level network isolation with custom CIDR block allocation
- Zero inbound public IP exposure with strictly private gateway peering
HIPAA, HITECH & FDA 21 CFR Part 11
Engineered for hospitals, clinical laboratories, and MedTech device operators who require strict regulatory adherence and verifiable electronic signatures.
Audited Standards & Certifications
- Business Associate Agreement (BAA) execution
- ePHI encryption at rest & in transit
- 21 CFR Part 11 tamper-proof audit trails
Technical Controls & Enforcement
- Automatic redaction of patient identifiers (PHI) in non-clinical log streams
- Cryptographic timestamped audit logs meeting Joint Commission inspection standards
- Emergency transport and clinical monitoring telemetry segregation
FIDO2 Hardware Quorum & Merkle Ledgers
All destructive operational interventions require dual-custody approval with hardware security keys (YubiKey / WebAuthn), backed by append-only cryptographic Merkle trees.
Audited Standards & Certifications
- Mandatory four-eyes peer verification
- Append-only SHA-256 Merkle tree ledger
- Zero standing administrator privileges
Technical Controls & Enforcement
- FIDO2 biometric or physical token presence required for high-risk actions
- Time-bounded break-glass emergency sessions with 100% forensic capture
- External timestamping authority anchoring to prevent retroactive log alteration
Cryptographic & Network Defense Baseline
Strict technical specifications applied to all Colibri cloud and dedicated tenant environments.
| Layer | Cryptographic Standard | Key Management & Rotation |
|---|---|---|
| Data at Rest | AES-256-GCM envelope encryption | Daily automated key rotation via AWS KMS / Google Cloud KMS |
| Data in Transit | TLS 1.3 with Perfect Forward Secrecy (ECDHE) | Automated 90-day certificate rotation; strictly no TLS 1.0/1.1 |
| Operational Quorum | FIDO2 / WebAuthn hardware-anchored credentials | Physical touch confirmation; zero static admin keys |
| Audit Trail Integrity | Append-only SHA-256 Merkle tree verification | External public timestamping anchor committed hourly |
| Local Browser Processing | Sandboxed WebAssembly memory isolation | 100% ephemeral client RAM; zero persistent server caches |
Request Our Compliance Package
Qualified enterprise security teams can request our latest SOC 2 Type II audit report, ISO 27001 certificate, and penetration testing executive summary.