Trilatic is the trade name of Ripplarity Inc, a Delaware corporation. This page states the security controls this site and the Arbitrator Workbench run today.
Data at rest is encrypted using a managed secret; data in transit is encrypted with TLS. Encryption keys are held outside the application and are never checked into the codebase.
Case material, seals, and audit entries are written to append-only, hash-chained stores. A record cannot be altered without breaking its seal, and every write is appended, never overwritten.
The public site accepts no file uploads. The eligibility pre-screen and the pre-check tools process the facts a caller types in and return an answer; nothing typed is retained beyond what each page's privacy notice states.
Any workspace notice that could carry protected health information is gated before rendering, so it is only ever shown to the workspace it belongs to.
HTTP Strict Transport Security, `X-Content-Type-Options: nosniff`, and a Content Security Policy are set on every response.
Report a suspected vulnerability to security@trilatic.com; see /.well-known/security.txt for the disclosure contact and current policy. We acknowledge within one business day.