Privacy And Security
Great Bernard NEVER shares or rents your data with or to anyone without your permission. Your data is treated as confidential and privileged. Our advisors are held to high standards in regard to the care and handling of your data. Your data is never shared without your permission.
Great Bernard is committed to maintaining the confidentiality, integrity, availability, and security of our current and prospective users. We adhere to the highest standards in security in order to keep your data private and secure at all times.
- Great Bernard completes an annual questionnaire to maintain compliance with PCI SAQ-A standards. Great Bernard does not store any credit card details, as this is handled via a payment processor that is PCI compliant.
- Great Bernard completes a third party NIST CSF assessment annually.
- Great Bernard uses SSL/TLS 1.2+ across all of our applications ensuring the communication between your browser and Great Bernard is private and secure.
Security from the ground up
Our applications are designed with security in mind. Security is a high priority requirement within every phase of our product development. We apply stringent processes to ensure the security of our systems and applications throughout design, development, testing, and day-to-day operations. We use a modern Software Development Lifecycle (SDLC).
Account and password protection
Great Bernard is designed so that you, and those designated by you, are the only individuals who can access your account. Your account is always password protected and we utilize a strong password policy and non-reversible hashing for storage of the password.
Industry-standard security and encryption
We are hosted on a modern cloud platform in multiple locations. Our cloud-based hosting affords us many built in protections. Our backups are encrypted and stored securely at our cloud provider. We employ active protections including 24/7/365 security monitoring, web application firewalls, and DDoS protection. Your data is encrypted in transit and at rest. Our infrastructure is hardened based on guidance from the Center for Internet Security (CIS) Benchmarks.
Data Security
Great Bernard is a modern web-based service, meaning the only requirements for using it are an Internet connection and a device that can access the Internet.
Data Backups
Great Bernard data is backed up daily with weekly backups stored indefinitely. These backups are versioned and replicated across geographic regions for resiliency. Great Bernard systems employ technology with built-in backup mechanisms. Great Bernard also maintains hot-standby database servers in separate geographic regions in the event of a primary database failure.
Uploaded Records
Documents directly uploaded to your account through Great Bernard are encrypted in transit over both public and private networks, using TLS 1.2+. For long term storage of your submitted forms, Great Bernard utilizes industry-standard encryption at rest.
Disaster Recovery
Paper records are vulnerable to all kinds of natural disasters, theft, or permanent loss, as are non web-based software systems. If the file folder or computer containing health information can be burned, flooded, blown away, stolen, or destroyed, that information is vulnerable. Great Bernard is completely web-based, and therefore, has built-in disaster recovery. Personal information is online, stored on off-site servers, and backed up on multiple additional servers located around the country.