In place today
Everything below is implemented and running now. Nothing in this section is aspirational.
Authentication
Secure sign-in built on a managed authentication provider, with password reset and session handling.
Role-based authorization
Access is governed by role — employees, managers, and elevated roles see only what their role permits.
Unit-level isolation
Units are isolated from one another. Members of one unit cannot reach another unit's data, and access within a unit is scoped to what a role needs.
Data minimization
The product is designed to collect and surface only the information a workflow actually needs.
Hosting & infrastructure
Runs on modern managed cloud infrastructure with encryption in transit.
Privacy-conscious design
Workflows are designed with healthcare privacy considerations in mind, including audit-aware patterns.
What we have not earned
If any of these is a hard requirement for your organization today, Adelo will not pass your review — and we would rather you knew that on the first call than the fourth.
- SOC 2Not certified. No audit has been completed and no report exists.
- HITRUSTNot certified.
- Independent security assessmentNot completed. No third party has yet reviewed the platform.
- “HIPAA certified”No vendor holds this, including us — HHS does not certify software as HIPAA compliant. Any vendor displaying such a badge is telling you something about how they handle claims generally.
On the roadmap
Availability & backup commitments
Formalized, documented backup and availability targets.
Vulnerability management program
A documented program with defined scanning cadence and remediation windows.
Independent third-party assessment
External security review as the platform matures, ahead of any certification work.
Adelo is scoped to exclude patient information.
This is a workforce operations product. It holds schedules, hours, attendance, credentials, messages between staff, and recognition. It does not hold clinical data. PHI should not be entered or uploaded — the platform is scoped to exclude it, and the workflows give no reason to. No Business Associate Agreement is required for the services described here.
That scope is not a limitation we’re apologizing for — it’s the reason a unit can be live in days rather than quarters. Most of what makes healthcare software slow to approve is the patient data it touches. Adelo touches none.
Responsible disclosure
Found a potential security issue? Email security@getadelo.com and we’ll respond promptly.
Evaluating Adelo for an IT or security review? There’s a page written for you.