Company-scoped isolation, a data region you pick, and a hard line between what HR can see and what stays with the individual. Private things are private by design here, not by policy alone.
Illustrative sample data.
Each customer sits in a company-scoped tenant on Vantage Fit, hosted in a data region you choose, with individual health data kept off every admin screen. HR sees aggregated, anonymized trends, not named health records. For current certification status and supporting documentation, request the security packet.
Each company is an isolated tenant, and every query, including anything touching health data, is scoped to that company. You choose where it is hosted.
Your data is a separate tenant. Records carry your company identifier throughout, and cross-company access is not possible by design.
Choose India, the US, the EU or the UAE at onboarding, served from region-specific endpoints so data stays in region.
The region is set at onboarding and does not change afterwards without a planned migration, so there are no surprises later.
Here is what is built today, and where we point you to your own due diligence rather than over-claim.
We describe only what we can stand behind, and give your team the paperwork to verify the rest.
We do not claim SOC 2, ISO 27001, GDPR compliance, blanket HIPAA compliance, audit logs or biometric app lock, because we cannot substantiate them here. For your assessment, request the current security documentation from your account team.
The whole model comes down to this split.
Each customer's data is logically isolated, so one company's employees, participation and health records are never visible to another. Access is scoped to your organization, and the aggregate-only rule for HR sits on top of that separation. In short, isolation between customers and de-identification within a customer are two different guarantees, and Vantage Fit applies both.
Employee data is stored in the region it belongs to, India, US, EU or UAE, so it stays under the right jurisdiction. We describe this as a data-handling fact rather than a certification claim. We align to HIPAA guidelines and GDPR, and we do not claim SOC 2, ISO or blanket-HIPAA certification we have not earned.
For anything beyond this page, your account team shares the current security and compliance documentation.
Walk through the isolation model, the residency options and the privacy boundaries with our team, and take the security packet to your reviewers.