Cookie Policy & Security Disclosures
1. Cookies and Similar Technologies
abastyan.com uses cookies and similar technologies (local storage) to operate the site, remember preferences, measure performance, and support lead routing for demo, pilot, and checklist requests. The Abastyan portals use strictly necessary cookies for authentication, session integrity, and CSRF protection.
Strictly necessary: session identifiers, authentication tokens, security tokens, load balancing. These cannot be disabled. Functional: language and display preferences, calculator inputs remembered between visits. Analytics: first-party and privacy-respecting third-party analytics measuring page views, section engagement, and conversion events; IP addresses are truncated. Marketing attribution: a first-party identifier that ties a form submission to its entry point (Book a Demo, Talk to Us, Pilot Request, ROI Calculator, Checklist Download, Chat Inquiry) for CRM routing. Chat: a session identifier and local storage entry that keep your chat conversation open as you move between pages; cleared when the conversation ends or after thirty (30) days of inactivity. We do not use third-party advertising cookies and do not permit cross-site tracking.
2. Managing Cookies
You may accept or decline non-essential cookies through the banner presented on first visit and may change your choice at any time through the "Cookie preferences" link in the footer. Browser settings also allow you to block or delete cookies; blocking strictly necessary cookies will prevent portal login. We honor Global Privacy Control signals: when your browser sends GPC, optional cookies are set to off and the preference center shows this.
Cookie table. abastyan_cookie_consent (first party, strictly necessary, 12 months): stores your choices and the policy version. abastyan_session (first party, strictly necessary, session): CSRF and session integrity on forms. abastyan_calc (first party, functional, 30 days): remembers calculator inputs. abastyan_analytics_id (first party, analytics, 13 months): privacy-respecting page and section analytics, IP truncated. abastyan_source (first party, attribution, 30 days): the page a form submission came from. abastyan_chat (first party, chat, 30 days or end of conversation): keeps the chat open across pages. Third-party analytics and chat providers are named in the Trust Center subprocessor list and set no cookies until you enable the category.
3. Security Program Overview
ReMyll maintains an information security program designed to the SOC 2 Trust Services Criteria (Security, Availability, Confidentiality) and the HIPAA Security Rule. The status and date of any independent SOC 2 report are stated in and available through the Trust Center to customers and qualified prospects under NDA. Where a report has not yet been issued, the Trust Center says so.
4. Encryption
All Customer Data is encrypted at rest using AES-256 and in transit using TLS 1.2 or higher. Encryption keys are managed in a hardware-backed key management service with automatic rotation; customer-managed keys are available on custom deployments. Backups are encrypted with separate keys and stored in a geographically separate region within the United States.
5. Access Control
Access to the Service is governed by least-privilege, role-based access control scoped by facility and entity. Sensitive fields are masked by default and revealed only on logged request by an authorized role. Multi-factor authentication is enforced for all administrative roles and available to all users; SSO via SAML 2.0 and OIDC and automated provisioning via SCIM are supported. ReMyll personnel access to production is restricted to on-call engineers, requires MFA and just-in-time approval, and is fully logged.
6. Audit Logging and Integrity
Every view, edit, export, login, permission change, and accepted suggestion is written to an append-only, tamper-evident audit log. Entries cannot be edited or deleted through the Service, and administrative access to log storage is restricted and itself logged. Logs are retained for the Subscription Term and the export window described in the customer agreement, and customers may export them at any time.
7. Availability and Resilience
Availability commitments, including the target percentage and service credits, are set out in the Service Level Agreement incorporated into the Order Form. Infrastructure is deployed across multiple availability zones with automated failover. Recovery point objective is one (1) hour and recovery time objective is four (4) hours. Disaster recovery is tested at least annually.
8. Vulnerability Management and Incident Response
Dependencies and infrastructure are scanned continuously; vulnerabilities are remediated on a risk-based schedule. A documented Security Incident Response Plan is exercised annually. Confirmed security incidents affecting Customer Data are reported to customers without unreasonable delay and within the timelines in the customer’s agreement. Security researchers may report vulnerabilities through the Contact us form on abastyan.com.
9. Workforce and Vendors
All ReMyll personnel complete background checks, sign confidentiality agreements, and complete HIPAA and security training at hire and annually. Subprocessors are assessed before engagement and annually thereafter, are bound by written security and, where applicable, BAA terms, and are listed in the Trust Center with thirty (30) days’ notice of additions.