AltraSync Trust Center
Security
Last updated: September 24, 2026. The controls AltraSync uses to protect accounts, company records and uploaded documents.
At a glance
Two-step sign-in for everyoneEmail code for all users; Google Authenticator for admins.
Company separationEach company only sees its own records and users.
Permission per pageAdmins turn on each menu per user.
Automatic cleanupUploaded documents are removed after the retention period.
Activity historySign-ins and admin changes are logged.
AI is off by defaultOnly an admin can turn it on.
Access control
- Every user signs in with their own account. There are three levels: Super Admin (AltraSync platform support), Company Admin and user.
- Company Admins choose which menus each user can open (Audit, Clients, Billing, Accounting and others). A Company Admin cannot give a user more than the Company Admin has.
- Records are separated by company. Users only see their own company, except billing agencies, which see the client companies they manage, and Super Admin, which supports all companies.
- Parents in the AltraKids Parent portal have separate accounts and see only the children linked to them. A provider can remove that link at any time.
- Removing a user turns off their sign-in right away; their history is kept.
Sign-in protection
- Passwords: at least 10 characters with upper and lower case letters, a number and a symbol. Passwords are stored only as a salted hash (PBKDF2-SHA256, 120,000 rounds), never as plain text.
- Two-step verification is required. Users confirm a recovery email and enter a 6-digit code sent by email (valid 10 minutes). Company Admins and Super Admin must use Google Authenticator and get recovery codes.
- Lockout: after 5 failed attempts, sign-in is paused for 15 minutes (default).
- Session timeout: sessions end after 120 minutes by default; Super Admin can change this.
- One active session: by default a new sign-in ends the user's older session.
- Disclaimer: users must accept the current use disclaimer and accept it again when it changes.
Application protections
- Every change (form or button) must carry a per-session security token, and requests from other websites are rejected (CSRF protection).
- Pages are sent with security headers that block framing by other sites (clickjacking), file-type sniffing and referrer leaks, and that stop browsers from caching private pages.
- When served over HTTPS, sign-in cookies are marked Secure and browsers are told to always use HTTPS (HSTS). Sign-in cookies cannot be read by page scripts.
Data storage and encryption
- The database, uploads, support attachments, logs and backups are kept in a data folder separate from the application code. Files can also be kept in Microsoft Azure storage.
- Stored passwords are hashed. Saved integration secrets (email server, Claim.MD, QuickBooks, OpenAI keys and authenticator secrets) are encrypted by the application.
- The application does not encrypt the database file or uploaded documents itself; disk and storage encryption depend on the hosting environment.
Uploads and company file guard
- The company file guard checks Audit Check and billing uploads against the company's name and aliases, and by default blocks files that belong to another company. Super Admin can switch a company to "warn only" or turn the guard off when needed.
- Only needed file types are accepted on each page (for example PDF, ZIP, spreadsheets, images). Chat attachments are limited to 10 MB.
- AltraSync never edits uploaded PDFs. Corrections are made in the source system and uploaded again.
Retention and backups
- Uploaded audit, insurance, intake, EOB, billing export, invoice and revenue files are removed automatically after the retention period (30 days by default). Cleanup runs nightly while automatic cleanup is on, and each removal is recorded in the Retention Log.
- With PHI-safe mode (on by default), client details in old results are cleared while counts, statuses and history stay.
- Cleanup never deletes users, companies, settings or activity history.
- Support attachments, chat, AltraKids and parent portal documents, clinical notes, authorizations and resumes are kept until removed; they are not part of the automatic cleanup.
- Backups are created by Super Admin and automatically before every update or restore, and can be restored from the System page.
AI and outside services
- AI features use OpenAI, are off by default, and only an admin can turn them on. Note review replaces client, provider and supervisor names, dates and long ID numbers before sending. The dashboard summary sends counts only. Details are in the Privacy Policy.
- AI token use is logged and visible only to Super Admin.
- Other services (Claim.MD, QuickBooks, email, Azure Speech and others) receive only what their feature needs. The full list is in the Privacy Policy.
Chat and support safety
- Team chat stays inside the company. A safety filter blocks unsafe messages and marks links or possible PHI for review.
- Deleted or cleared chat messages are hidden from the company but kept for Super Admin review.
- Support tickets include the page, company and user so we can help faster. Please don't attach PHI unless it is needed.
Activity logs
AltraSync records sign-ins, failed attempts, permission and settings changes, uploads, deletions, retention cleanup and support activity. Company Admins can review their company's activity; Super Admin can review all activity. Activity history is kept and is not removed by cleanup.
Incident response
Report a suspected security or privacy problem through Support or to support@altrasync.com. We review the logs, keep the evidence, contain the issue and notify affected customers without unreasonable delay so they can meet their own notice duties.