Privacy & security
What CommonLight holds, what it doesn't, and how we work with your security team.
What we hold and what we don't
Information about programs, not people.
CommonLight's product is information about community programs: organizations, their locations, and the services they offer, with when and how each listing was checked. It does not contain information about patients, members, or clients, and we do not need any to do our work. Like any business, we do keep some ordinary contact information: the names and work contact details that providers publish for their programs, notes from our verification calls with provider staff, and what you send us through this website. Please do not send us information about the people you serve.
HIPAA
Designed to work without protected health information.
CommonLight is designed so that it never needs to receive protected health information. We work with information about programs, not people.
How it's protected
Evidence, not a checklist.
We'd rather show your security team how the service is hosted and protected than list controls on a web page. During evaluation we can complete your security questionnaire.
Certifications
Where we stand today.
We do not yet hold a SOC 2 report. We can complete a security questionnaire during evaluation.
Contact
Questions or concerns.
For security questions, or to report a concern, write to security@wearecommonlight.com