Bakerford® Security & Trust Policy

Overview

Bakerford® is committed to protecting the confidentiality, integrity, and availability of customer data. All customer data is stored, processed, and transmitted using secure, compliant systems located in U.S.-based data centers through trusted service providers, including NinjaOne, Zendesk, Google Workspace, and HubSpot. These platforms maintain and undergo independent audits for industry-leading compliance certifications and frameworks. Bakerford® enforces internal security measures that meet or exceed these standards.

1. Data Storage & Processing

All data entrusted to Bakerford® is:

  • Hosted in the United States, unless otherwise agreed in writing.
  • Stored in infrastructure that holds relevant certifications (e.g., SOC 2, ISO 27001, HIPAA, GDPR, CCPA, FedRAMP where applicable).
  • Processed through encrypted channels using TLS 1.2 or higher for in-transit data, and AES-256 encryption for data at rest.

Our primary trusted platforms include:

Platform Standards & Certifications
NinjaOne ISO 27001:2022; SOC 2; SOC 3; HIPAA; CCPA; GDPR; NIS 2 Directive; FedRAMP (In Process – Review Status); aligned with NIST CSF, NIST SP 800-171, NIST SP 800-53, DFARS, and CMMC Level 3.
Zendesk SOC 2 Type II; ISO 27001:2022; ISO 27017:2015; ISO 27018:2019; ISO 27701:2019; PCI-DSS; HIPAA; FedRAMP LI-SaaS; HDS; McAfee Enterprise Ready; Cloud Security Alliance (STAR Registry); IT-ISAC; FIRST; FSQS; CCPA; GDPR.
Google Workspace SOC 2; SOC 3; ISO 27001; ISO 27017; ISO 27018; FedRAMP Moderate; CCPA; GDPR; EU Cloud COC; TRUSTe.
HubSpot SOC 2 Type II; SOC 3; ISO 27001; CCPA; GDPR; EU-U.S. Data Privacy Framework; UK-U.S. Data Bridge; HIPAA-ready Sensitive Data program; TRUSTe.

Subprocessors:
Each provider maintains its own vetted list of subprocessors, which can be found here:

2. Internal Access Controls

Bakerford® enforces Multi-Factor Authentication (MFA) for all system and data access:

  • MFA must use a separate physical device in addition to a password (e.g., YubiKey, passkeys).
  • Access rights follow the principle of least privilege and are reviewed regularly.
  • All endpoints accessing sensitive data are encrypted, monitored, and managed.
  • Session timeouts and device tracking are in place to prevent unauthorized persistence.

Bakerford® adheres to NIST, HIPAA, HITECH, and other applicable U.S. federal and state laws for security and data protection.

3. Encryption & Data Protection

  • In Transit: All communications use TLS 1.2 or higher.
  • At Rest: Data is encrypted with AES-256.
  • Application-Level Encryption: Sensitive and highly sensitive fields (per HubSpot definitions) receive per-tenant encryption keys.
  • Access Logging: All access to sensitive data is logged and monitored.

4. Incident Response

  • Security events are continuously monitored.
  • Breach Notification: In the event of a breach affecting your data, Bakerford® will notify you within 72 hours of confirmation, including:
    • Nature and scope of the incident
    • Data types affected
    • Our Plan of Action for containment, remediation, and prevention.

If an incident results from customer actions, non-compliance, or unmanaged third-party systems, remediation will be billable and outside of any guarantees or SLAs.

5. Customer Responsibilities

Customers must:

  • Maintain BAAs with any non-managed vendors that store or process PHI/PII (e.g., EHR, billing systems).
  • Use only approved and managed software/hardware for PHI/PII handling.
  • Immediately report personnel changes affecting system access so Bakerford® can disable credentials or adjust permissions.

Cookies and Tracking

Bakerford® uses cookies and similar technologies to improve your experience, monitor site usage, and support essential website functionality. You can manage cookie settings through your browser. For more information, see our Privacy Policy.

Contact Us

If you have any questions about security or privacy at Bakerford®, please contact us:
support@bakerford.com
Bakerford Technologies LLC, 2510 132nd Ave SE, Norman, OK 73026

Last Updated: August 10, 2025

This policy describes our current practices. We may update it periodically as our security program evolves.