The average cost of a data breach globally in 2025 is $5.3 million. For healthcare organizations violating HIPAA, penalties can reach $1.5 million per incident. When it comes to enterprise communication platforms, security isn't a feature — it's an existential requirement.
This guide covers everything you need to evaluate security in a communication platform: encryption standards, compliance frameworks, audit requirements, and the specific considerations for different industries.
The Security Landscape in 2025
Communication platforms are high-value targets for attackers:
- They contain sensitive business conversations and customer data
- They often have access to multiple integrated systems
- They process high volumes of data that can be exfiltrated
- They're increasingly used for authentication and identity verification
Yet many organizations still use consumer-grade tools for business communication, exposing themselves to significant risk.
Encryption: The Foundation
Encryption at Rest
Data stored in databases, file systems, and backups should be encrypted with:
- AES-256-GCM: The current gold standard. AES-128 is acceptable; anything less is inadequate.
- Key management: Keys should be stored separately from encrypted data, ideally in a hardware security module (HSM).
- Automatic rotation: Keys should rotate regularly (at least annually) without service interruption.
Encryption in Transit
All data moving between clients, servers, and integrations should be protected:
- TLS 1.3: The latest protocol version. TLS 1.2 is acceptable; anything older is a red flag.
- Certificate pinning: Prevents man-in-the-middle attacks on mobile applications.
- Perfect forward secrecy: Ensures that compromise of long-term keys doesn't expose past sessions.
End-to-End Encryption (E2EE)
For the most sensitive communications, end-to-end encryption ensures that even the platform provider cannot read message content. However, E2EE has tradeoffs:
- Pro: Maximum privacy — only sender and recipient can read messages
- Con: Limits server-side features like AI processing and search
- Con: Complicates compliance requirements that mandate message retention
Understand whether your use case requires E2EE or if strong encryption at rest and in transit is sufficient.
Compliance Frameworks
SOC 2 Type II
SOC 2 (Service Organization Control 2) is an auditing standard developed by the AICPA for service providers handling customer data. It evaluates five Trust Services Criteria:
- Security: Protection against unauthorized access
- Availability: System accessibility as agreed in contracts
- Processing integrity: Accurate and authorized processing
- Confidentiality: Protection of confidential information
- Privacy: Personal information handling per stated policies
Type I vs. Type II:
- Type I: Point-in-time assessment of control design
- Type II: Evaluation of control effectiveness over a period (typically 6-12 months)
Type II is far more meaningful — it proves controls actually work over time.
HIPAA
The Health Insurance Portability and Accountability Act mandates protection for Protected Health Information (PHI). If your communication platform will handle any health-related data, HIPAA compliance is legally required.
Key HIPAA requirements for communication platforms:
- Privacy Rule: Standards for PHI use and disclosure
- Security Rule: Administrative, physical, and technical safeguards for electronic PHI (ePHI)
- Breach Notification Rule: Procedures for notifying affected parties after a breach
- Business Associate Agreements: Contracts with any vendor handling PHI
Email/communication specific: All communication beyond the firewall must use end-to-end encryption. Access controls must ensure only authorized recipients receive communications. AES 128, 192, or 256-bit encryption is recommended.
Retention: HIPAA requires retaining communication-related documents for a minimum of 6 years.
GDPR
The General Data Protection Regulation applies to any organization handling EU residents' data. Key requirements:
- Data minimization: Collect only necessary data
- Right to deletion: Ability to delete user data on request
- Data portability: Export user data in standard formats
- Consent management: Clear opt-in for data processing
- Breach notification: 72-hour notification requirement
Industry-Specific Compliance
Depending on your industry, you may need:
- PCI DSS: Payment card data handling
- FINRA/SEC: Financial services communication archival
- FedRAMP: US government cloud services
- HITRUST: Healthcare industry framework harmonizing HIPAA and SOC 2
Access Control
Robust access control is fundamental to platform security:
Authentication
- Multi-factor authentication (MFA): Should be required, not optional
- SSO integration: Support for SAML 2.0 and OAuth/OIDC
- Password policies: Enforcement of strong passwords with rotation
- Session management: Automatic timeout and revocation capabilities
Authorization
- Role-based access control (RBAC): Permissions assigned to roles, not individuals
- Least privilege: Users get minimum necessary access
- Granular permissions: Control at the feature and data level
- Separation of duties: Prevent any single user from having excessive control
Audit and Logging
Complete audit trails are essential for compliance and incident response:
What to Log
- All authentication events (success and failure)
- Permission changes and administrative actions
- Message access and export activities
- Configuration changes
- Integration activities
Log Requirements
- Immutability: Logs cannot be modified or deleted
- Retention: Minimum 1 year, ideally longer for compliance
- Accessibility: Easy export for audits and investigations
- Alerting: Real-time notifications for suspicious activity
Third-Party Risk
Your communication platform's security is only as strong as its weakest integration:
- Vendor assessment: Evaluate security posture of all connected services
- Data sharing: Understand what data flows to third parties
- Business associate agreements: Required for any vendor handling PHI
- Ongoing monitoring: Vendors can regress — continuous assessment matters
Incident Response
Evaluate how your platform handles security incidents:
- Response plan: Documented procedures for different incident types
- Communication: How and when customers are notified
- SLAs: Committed response and resolution times
- Post-incident: Root cause analysis and preventive measures
Self-Hosted vs. Cloud
For organizations with strict data sovereignty requirements, self-hosted deployment may be necessary:
Self-Hosted Advantages
- Complete control over data location and access
- Ability to implement additional security layers
- No dependency on vendor's security practices
- May be required for certain government or defense applications
Cloud Advantages
- Faster updates and security patches
- Vendor handles infrastructure security
- Lower operational overhead
- Often better security than organizations can achieve alone
Security Evaluation Checklist
When evaluating a communication platform, verify:
Encryption:
- ☐ AES-256 encryption at rest
- ☐ TLS 1.3 in transit
- ☐ Key management and rotation
Compliance:
- ☐ SOC 2 Type II certification
- ☐ HIPAA compliance (if needed)
- ☐ GDPR compliance (if needed)
- ☐ Industry-specific certifications
Access Control:
- ☐ MFA required
- ☐ SSO support
- ☐ RBAC with granular permissions
Audit:
- ☐ Complete activity logging
- ☐ Immutable audit trails
- ☐ Long-term retention
Deployment:
- ☐ Self-hosted option (if needed)
- ☐ Data residency controls
- ☐ Backup and disaster recovery
OneStream Security
At OneStream, security is foundational, not an afterthought:
- AES-256-GCM encryption at rest
- TLS 1.3 for all data in transit
- SOC 2 Type II ready architecture
- HIPAA compliance ready for healthcare customers
- Complete audit trails with immutable logging
- Self-hosted option for complete data sovereignty
- Role-based access control with granular permissions