We recognize that our clients entrust us with sensitive operational and possibly healthcare-related information, so protecting that data is critical. Packem is hosted on Amazon Web Services (AWS) and leverages HIPAA-compliant AWS services to ensure all data is handled securely and in accordance with industry regulations.

Hosting on AWS and HIPAA Compliance

• Secure AWS Cloud Infrastructure: Packem is hosted on Amazon Web Services (AWS), which means our platform benefits from AWS’s extensive security investments. AWS data centers and services are certified for high security standards and compliance frameworks. In particular, AWS offers a HIPAA-eligible environment for handling protected health information – PackemWMS uses only HIPAA-compliant AWS services under an executed Business Associate Agreement (BAA) to meet rigorous healthcare data protection requirements. This cloud foundation ensures that our system’s underlying hardware, network, and facilities adhere to strict security and privacy controls.

• AWS Built-in Protections: By running on AWS, Packem inherits a suite of industry-leading security features. For example, AWS’s network firewalls (such as Security Groups and NACLs) and Virtual Private Cloud isolation help lock down our environment, allowing access only to authorized traffic. AWS provides robust DDoS (Distributed Denial of Service) protection at the network edge to guard against large-scale attacks, as well as tools like AWS Shield and AWS WAF to filter out malicious traffic. In addition, AWS has automated monitoring and logging services (like Amazon CloudWatch and AWS CloudTrail) that we utilize to continuously oversee the health and security of our environment. These services can automatically alert our engineers to unusual activities or potential issues, enabling quick response.

Data Encryption at Rest and in Transit

• Encryption at Rest: All customer data managed by Packem is encrypted at rest to protect its confidentiality. Our primary databases run on Amazon RDS, where the storage volumes are encrypted using strong AES-256 encryption. This means that the data residing in our databases (including any automated backups, read replicas, and snapshots) is scrambled using a 256-bit key, making it unreadable to anyone without the proper decryption keys. Even if an unauthorized person were to gain access to the physical disks or backup files, the encrypted data would be useless to them. PackemWMS relies on AWS Key Management Service (KMS) to manage encryption keys securely, adding an extra layer of control.

  aws.amazon.com

• Encryption in Transit: Data in transit between clients and PackemWMS is equally protected. We enforce Transport Layer Security (TLS) encryption (the successor to SSL) for all communications. Whether you are accessing the Packem web interface, calling our APIs, or transferring data between Packem and other systems, the information is sent over HTTPS with TLS. This ensures that sensitive data (such as login credentials, inventory data, or any transaction details) cannot be intercepted or read by eavesdroppers while it travels over the internet. By using the latest TLS protocols and strong cipher suites, Packem defends against man-in-the-middle attacks and guarantees the integrity and confidentiality of data during transfer. In summary, from the moment data is stored in our databases to the moment it is transmitted to authorized users, it remains encrypted and secure.

Regular Security Audits with Microsoft

PackemWMS doesn’t rely solely on built-in safeguards – we actively audit and test our security on a regular basis. In fact, we undergo periodic security audits in collaboration with Microsoft. By partnering with Microsoft’s security experts, we benefit from an external, seasoned perspective on our platform’s security posture. During these audits, our entire system is examined for potential vulnerabilities, misconfigurations, or gaps in compliance. The audit process can include code reviews, configuration inspections, and infrastructure assessments that align with best practices recommended by both AWS and Microsoft’s security frameworks.

Findings from these audits are taken seriously: if any potential vulnerability is identified, it is promptly addressed with remediation steps or improvements to our policies. In addition to formal audits, PackemWMS also performs routine vulnerability assessments and penetration testing.

These tests simulate real-world attacks on our application and infrastructure to ensure we can withstand them. The combined efforts of internal testing and external audits (with Microsoft’s involvement) give our clients confidence that PackemWMS’s security is continuously being validated and strengthened.

Disaster Recovery and Backup Procedures

Disaster recovery is a critical component of PackemWMS’s overall security and reliability strategy. We have designed our system with the assumption that unexpected incidents can happen, and we plan accordingly to minimize any impact on our clients’ operations. Here are some key elements of our disaster recovery and backup practices:

• Automated Backups: PackemWMS performs automated backups of all critical data on a regular schedule (daily incremental backups, with additional transaction log backups for databases). These backups include the data in our databases and important configuration states. All backup files are themselves encrypted and stored securely, often in multiple AWS regions or availability zones. By having frequent restore points, we ensure that in worst-case scenarios we can recover data up to a recent state and limit data loss.
• Redundant Storage & High Availability: Our production database is configured with high availability in mind. We leverage AWS’s Multi-AZ (Availability Zone) deployments for Amazon RDS, meaning there is a standby replica of the database in a different physical location (data center). This redundancy ensures that if the primary database instance experiences an outage (due to hardware failure, network issues, etc.), the system can fail over to the secondary instance with minimal disruption. Similarly, for our application servers and other components, we utilize load balancing and multiple instances across availability zones. Redundant storage of backups (for example, in Amazon S3 with cross-region replication) adds another layer of protection in case an entire region has an issue.
• Rapid Recovery Mechanisms: In the event of any incident – whether it’s a natural disaster, technical failure, or security incident – PackemWMS has established procedures to quickly restore full service. We routinely test our disaster recovery process by simulating scenarios and ensuring we can meet our Recovery Time Objective (RTO) and Recovery Point Objective (RPO). Essentially, RTO is the target time to fully restore services, and RPO is the acceptable amount of data (time window) that might be lost. Our systems are configured so that we can restore from backups or switch over to standby systems rapidly, often with zero data loss (thanks to real-time replication) and very short downtime. These drills and measures guarantee that even in a worst-case scenario, PackemWMS can recover swiftly and clients can resume normal operations quickly. The combination of frequent backups, geographically redundant infrastructure, and tested recovery playbooks means our clients’ data remains safe and available no matter what happens.

Access Control and Security for Production Data

Protecting production data at the access level is under Packem’s security practices. We implement strict controls to ensure that only the right people can get to sensitive information, and even then, that their access is limited and monitored. Our approach to access security includes the following:

• Strict Access Permissions: enforces the principle of least privilege for all user accounts and personnel. This means each employee, service, or process is given only the minimum level of access necessary to perform their function – nothing more. Access to production databases, servers, and sensitive tools is tightly restricted to a very small number of authorized team members. Before anyone can reach production data, they must go through approval processes and their access is reviewed regularly. By minimizing who can see or change sensitive data, we greatly reduce the risk of insider threats or accidental changes.
• Multi-Factor Authentication (MFA): Any access to critical systems (such as administrative consoles, database management interfaces, or cloud infrastructure dashboards) requires multi-factor authentication. Even if an authorized user has the correct password, they must still provide a second factor (like a time-based one-time code or hardware token) to prove their identity. This two-factor authentication adds a strong barrier against compromised credentials – an attacker would need more than just a password to break in. MFA is enforced for our engineers, support staff, and anyone with elevated privileges in the PackemWMS environment.