Security
Secure by design. Built on enterprise cloud.
Lemonade runs on enterprise-grade cloud infrastructure in US data centers, the kind used by healthcare organizations, financial institutions, and government agencies. We build every form, upload, and workflow on top of it with sensitive information in mind.
Your client
Client
Fills out a form on any device
Lemonade application
Lemonade secures
Secure forms, uploads, records, and workflows
- Encrypted at rest
- Audit logs
- Automated backups
- US-only hosting
- HIPAA-compliant healthcare forms
Enterprise cloud infrastructure
Provider secures
US data centers, hardware, and network
Every Lemonade form
Sensitive information, handled the way it should be.
No PDFs bouncing between inboxes. No documents sitting in email attachments. Information goes from your client's device to your team through a secure form.
Encrypted in transit
Every form is served over an encrypted HTTPS connection, so information is protected on its way from your client to you.
Secure document uploads
Clients upload documents directly through the form instead of attaching them to email.
HIPAA-compliant healthcare forms
All forms are secure. Healthcare forms are HIPAA compliant for intake, consents, and referrals.
Fewer hand-offs
We avoid unnecessary third-party integrations, so sensitive information passes through fewer systems.
Lemonade security controls
What we secure on top of the infrastructure.
Our cloud provider secures the physical infrastructure. These are the controls Lemonade adds to protect your data.
Encrypted at rest
Stored data is encrypted, not just data in transit.
US-only hosting
Your data is hosted in data centers in the United States.
Audit logs
A record of who viewed or changed data.
Automated backups
Data is backed up automatically.
Business Associate Agreements
We have a signed BAA with our cloud infrastructure provider, and we sign BAAs with our healthcare customers.
Multi-factor authentication
Available on every account. We strongly recommend that clients turn it on.
Internal penetration testing
We test our own systems for weaknesses.
Infrastructure
Built on an enterprise cloud foundation.
Security in the cloud is a shared responsibility. Our provider secures the infrastructure. Lemonade secures what we build on it.
Physically secured data centers
Our data centers use controlled access, on-site security, and continuous monitoring.
Isolated, redundant facilities
Infrastructure is spread across multiple isolated facilities within US regions.
Independently audited programs
Our infrastructure provider maintains third-party audited compliance programs for its data centers and network.
Built for healthcare workloads
The infrastructure is designed for healthcare workloads and covered by a Business Associate Agreement.
Our provider's compliance programs, audit reports, and attestations cover its infrastructure. They are not certifications of Lemonade OS.
Questions from your security or compliance team?
We're happy to walk through hosting, data handling, and how your forms are set up.