United States
commcarehq.org
SECURITY
Enterprise-grade data security
Trusted by governments, nonprofits, and research institutions, across your choice of secure cloud locations.
- Encrypted data
- Choice of cloud location
- 99% uptime
- Trusted by governments
dimagi.safebase.us
One window into how we keep your data safe
Security posture, compliance reports, and architecture documents in one place. Everything procurement, IT, and security teams need to evaluate CommCare.
OUR FOUNDATION
Audited against the world’s highest standards
Independent third-party audits keep CommCare aligned with SOC 2 Type 2, HIPAA, and GDPR.
HIPAA
Protected health data
Business Associate Agreements available on Advanced and Enterprise plans for PHI workloads.
SOC 2 Type 2
Independently audited
Annual third-party audits across security, availability, and confidentiality.
GDPR
Privacy by design
Data residency options and data-subject rights honored across the platform.
Reports stay current and audits run annually.
SECURITY FEATURES
Security at every stage. From collection to sharing
Secure Collection
Role-based permissions and encryption protect data from the moment it’s collected.
Advanced Authentication
Multi-factor authentication (MFA) and single sign-on (SSO) keep accounts secure.
Secure Workflow Automation
Automates data routing and decisions to limit exposure from manual handling.
Controlled Sharing
Data is securely shared through authenticated APIs, and controlled by group- and location-based access policies.
Secure Storage
SOC 2–compliant cloud hosting with high availability and automated backups.
Detailed Audit Logging
HIPAA-compliant auditing for all covered entities.
status.commcarehq.org.View status ↗CLOUD OPTIONS
Choose where your data lives
Three AWS-hosted locations, one platform. Same features, support, and security posture, wherever your data needs to live.
European Union
eu.commcarehq.org
India
india.commcarehq.org
COMMON QUESTIONS
Security FAQs
Compliance & Certifications
Is CommCare HIPAA compliant?
Yes. CommCare supports HIPAA-compliant data handling, including detailed audit logging for covered entities. Business Associate Agreements are available on Advanced and Enterprise plans for protected health information workloads.
Is CommCare SOC 2 certified?
Yes, CommCare is SOC 2 Type 2 certified, with annual third-party audits across security, availability, and confidentiality.
Does CommCare comply with GDPR?
Yes. CommCare is aligned with the European Union’s General Data Protection Regulation (GDPR), with data residency options and data-subject rights honored across the platform.
How can our IT and procurement teams evaluate CommCare?
The Dimagi Trust Center at dimagi.safebase.us gathers security posture, compliance reports, and architecture documents in one place. Reports stay current and audits run annually.
Hosting & Operations
Where is CommCare data hosted?
You choose from three AWS-hosted cloud locations: the United States at commcarehq.org, the European Union at eu.commcarehq.org, and India at india.commcarehq.org. Each offers the same features, support, and security posture.
How is data protected day to day?
Data is protected with AES-256 encryption and role-based permissions from the moment it is collected. Multi-factor authentication (MFA) and single sign-on (SSO) keep accounts secure, and sharing is controlled by group- and location-based access policies through authenticated APIs.
What uptime can we expect?
CommCare maintains 99.9% verified uptime, backed by 24/7 monitoring and incident response, with a public status page at status.commcarehq.org.
Is security included in every plan?
Yes. Every plan includes SOC 2 and GDPR security with HIPAA-compliant data handling, plus secure cloud hosting, with affordable plans from $100 per month. A signed HIPAA Business Associate Agreement is available on Advanced and Enterprise plans.