Platform & Data Security
At Empyrean, security isn’t a “check-the-box” obligation – it’s our relentless commitment to your peace of mind.
Protection You Can Trust
We’ve implemented multiple layers of security controls to protect the sensitive information entrusted to us by your organization, partners, and employees.
With technology and security needs constantly evolving, we go beyond basic compliance to deliver enterprise-grade protection that’s continuously monitored and independently validated – keeping your data safe at all times.
Proven to Protect
Empyrean’s security program is built on industry-leading standards and backed by independent audits and validations that demonstrate our controls are active, effective, and continuously improving.
SOC 1 Type II & SOC 2 Type II
We complete annual, third-party audits that ensure the effectiveness of our internal controls—vital for clients with SOX or financial reporting obligations.
ISO/IEC 27001 Certification
Continuously maintained through internal audits and a structured improvement cycle, supporting our global information security management standards.
HIPAA & NIST Alignment
Empyrean meets the technical, administrative, and physical safeguards required for HIPAA compliance and adheres to the NIST 800-53 framework for information security.
Transparent Third-Party Ratings
Our security program is independently assessed and continuously monitored through trusted risk rating platforms:
These independent ratings provide a clear, outside-in view of how we’re performing across critical areas – like keeping systems clean, applications secure, and defenses up to date. We use this feedback to measure progress, make improvements, and stay transparent with our clients.
Secure by Design. Resilient by Default.
Empyrean’s infrastructure and development practices are designed to protect data at every layer:
Dedicated Client Databases
Each client has their own dedicated database environment – never shared with anyone else.
AES-256 Encryption
Your data is protected with AES-256 encryption, keeping it secure both in storage and in transit while meeting federal security standards (FIPS 140-2)
24/7/365 Monitoring
We continuously monitor our systems with centralized security tools (SIEM and endpoint detection) to identify anomalies or threats.
Secure Hosting & Uptime
Our services run from secure, U.S.-based Tier III data centers with a 99.95% uptime guarantee, supported by a disaster recovery plan tested annually.
Penetration Testing & Scans
Third-party penetration tests are conducted semi-annually, supported by monthly vulnerability scanning and regular configuration audits.
Protecting Your People’s Most Sensitive Data
From onboarding to open enrollment, Empyrean safeguards millions of participant records—including PHI, PII, and financial data—with strict access controls and ongoing employee training. Multifactor authentication (MFA), phishing simulations, and role-based permissions ensure that only the right people access the right data.
Ready to Get Started?
Learn more about Empyrean, our secure, configurable benefits technology, and how we help leading organizations protect data while delivering an exceptional experience for employees and HR teams.
Let's Talk »