Security is not a feature. It is the architecture.
LightTrail was built for healthcare from the ground up. Security and compliance are not bolt-on features or afterthoughts. They are embedded in every layer of the platform, from how data enters the system to how it is stored, processed, and surfaced to your team.
Infrastructure
LightTrail runs on enterprise-grade cloud infrastructure with workload isolation between every service. Each customer environment is isolated at the tenant level, meaning your data is logically separated from all other customers at every layer of the stack.
The platform is built to scale horizontally without compromising the isolation boundaries between tenants. As your data volume grows, the architecture expands to meet it without any changes to your security posture.
Infrastructure changes are managed as code through version-controlled definitions. Every change to the environment is tracked, auditable, and reproducible. There are no undocumented manual modifications to production.
All data is encrypted at rest using AES-256 and in transit using TLS 1.2 or higher. There is no path for unencrypted data within the platform.
Data Handling
LightTrail captures behavioral engagement data, including pages visited, session flow, campaign attribution, and geographic context, giving your marketing team the complete picture they need to make good decisions.
The platform operates within a fully HIPAA-compliant environment, covered by a Business Associate Agreement. Data handling practices are designed to minimize risk and are documented in detail for security reviews during procurement.
Want the full technical walkthrough? Our team provides detailed architecture documentation and data-flow diagrams during security reviews. Request a security review.
Access and Authentication
Access to LightTrail is controlled through role-based access controls. Each user is assigned a role that determines what they can see and do within the platform, and access is scoped to the data your organization is permitted to view.
Enterprise customers can authenticate through SSO using Microsoft Entra or any SAML 2.0-compatible identity provider. This means your existing identity governance policies, including MFA requirements and conditional access rules, apply to LightTrail without additional configuration.
Every user action and system event is captured in immutable audit logs. If your compliance team or a third-party auditor needs to understand who accessed what data and when, that record exists.
Role-Based Access Controls
Granular permissions scoped to your organization's structure.
SSO / SAML 2.0
Integrate with Microsoft Entra or any SAML-compliant identity provider.
Immutable Audit Logs
Complete record of every user action and system event, always available.
Compliance
LightTrail is designed to operate within the requirements of HIPAA. We execute Business Associate Agreements with every customer who processes protected health information through the platform. Our compliance posture is continuously monitored, not assessed once a year.
Compliance evidence, control documentation, and detailed architecture walkthroughs are available during security reviews. If your procurement or compliance team needs to evaluate LightTrail's posture in detail, request a security review.
Questions
Security and compliance teams often have questions specific to their organization's requirements that go beyond what is documented here. If you need a custom security review, have questionnaires to send through, or want to talk through how LightTrail fits into your procurement process, we are available.