There is no vendor server for you to assess.
A MedLicense workspace is a folder in your own SharePoint or OneDrive, encrypted on each device with keys that only your team’s devices hold. We never receive your data, so most of a vendor questionnaire has a short answer.
What your security team will ask.
- EncryptionEvery file is sealed with AES-256-GCM on the device before upload. Device keys use ECDH and ECDSA on NIST P-256, with HKDF-SHA256 to derive keys.
- Key managementEach device holds its own keys in the Keychain on Apple devices. The workspace key is wrapped separately for every approved device, and removing a person rotates it.
- AccessSharePoint permissions are the hard boundary, and viewers should be given Read. Four workspace roles, owner, admin, coordinator and viewer, control what the app shows and permits.
- Sign-inMicrosoft Entra ID with delegated permissions only, namely Files.ReadWrite.All, User.Read and offline_access. No application permissions are requested.
- AuditEach change is recorded in a log that the acting device signs, and the app marks any entry whose signature does not verify.
- Data residencyYour Microsoft 365 tenant and its region. MedLicense the company holds no copy.
- SubprocessorsThere are none. The only services involved are your own Microsoft 365 tenant and the public registries, such as NPPES and the OIG exclusion list, that a user asks the app to check.
- Networklogin.microsoftonline.com, graph.microsoft.com, npiregistry.cms.hhs.gov and the public OIG and CMS data files
What the design cannot do.
These limits are written down here so that nobody has to discover them in a pilot.
- Downloaded files stay downloaded.A person who is removed keeps any files they had already downloaded. Rotating the key protects everything written afterwards, which is why offboarding also removes their SharePoint access.
- The Graph backend is pre-release.The Microsoft Graph storage backend is implemented but has not yet been tested against a production Microsoft 365 tenant, so we suggest a small pilot first. The synced-folder option needs no Graph permissions.
- There has been no third-party review.MedLicense has no SOC 2 report and has not had a penetration test yet.
- The Mac app is the one available today.The iPhone, Windows and Android apps are coming soon and use the same vault format.
Short answers for the questionnaire.
The security overview has the full set, written to be attached to a vendor assessment. The HIPAA wording is not legal advice.
Do you support single sign-on?
Yes. People sign in with Microsoft Entra ID, so your own multi-factor authentication and conditional access policies apply.
Do you support SCIM?
No. Members join with a six-digit code that an owner or admin approves, and an admin removes them in the app together with their SharePoint permissions.
Do you have a SOC 2 report?
Not yet. Because there is no vendor-hosted data, there is no MedLicense service for such a report to cover, but we do not have a report to give you.
Have you had a penetration test?
Not yet, and the code has not had an independent security assessment.
Where is our data stored?
In the SharePoint or OneDrive location you choose, inside your own Microsoft 365 tenant. MedLicense the company stores nothing.
Is MedLicense a HIPAA business associate?
MedLicense the company never receives, stores or transmits protected health information from a workspace, so we do not consider it a business associate for workspace data. Please confirm this with your compliance team, because it is not legal advice.
Who do we tell about a vulnerability?
A security contact address will be listed here when it is published. Until then, the IT setup guide that ships with each download is the best reference.
Give IT the two documents they need.
The setup guide covers Entra admin consent, the SharePoint folder, deployment to each platform and offboarding, and the overview answers the rest of the questionnaire.
Draft, pending legal review.
This page describes how the product is designed and is not a certification or an audit report. Related pages: privacy, health data privacy, business terms, accessibility and editorial standards.