Lyra Health | Trust Center
Lyra Health
Lyra Health, a leading provider of innovative mental health benefits for more than 2.2 million global employees and dependents, is transforming mental health care by creating a frictionless experience for members, providers, and employers. Using matching technology and an innovative digital platform, Lyra quickly connects companies and their employees - plus spouses and children - to world-class therapists, mental health coaches, and personalized medication prescribing.
See Resources

Resources

Pen Test Report

October 2023

Hitrust

September 2023

SOC2 Type II

October 2023

ISO27001

ISO 27001:2022 certificate (September, 2025)

Privacy Policy

To learn more about our privacy click below

Security Webpage

To learn more about our security click below

Subprocessors List

SIG Questionnaire

CAIQ

HECVAT Lite

View all

Subprocessors

Monitoring

Continuously monitored by Secureframe
View all

Compliance

SOC 2 Type 2

ISO 27001

HITRUST

GDPR

CCPA

Monitoring

Change Management

Segregation of Environments
Development, staging, and production environments are segregated.
Secure Development Policy
A Secure Development Policy defines the requirements for secure software and system development and maintenance.
Configuration and Asset Management Policy
A Configuration and Asset Management Policy governs configurations for new sensitive systems
Production Data Use is Restricted
Production data is not used in the development and testing environments, unless required for debugging customer issues.

Availability

Testing the Business Continuity and Disaster Recovery Plan
The Business Continuity and Disaster Recovery Plan is periodically tested via tabletop exercises or equivalents. When necessary, Management makes changes to the Business Continuity and Disaster Recovery Plan based on the test results.

Organizational Management

Acceptable Use Policy
An Acceptable Use Policy defines standards for appropriate and secure use of company hardware and electronic systems including storage media, communication tools and internet access.
Independent Advisor
The board of directors or equivalent entity function includes senior management and external advisors, who are independent from the company's operations. An information security team has also been established to govern cybersecurity.
Internal Control Monitoring
A continuous monitoring solution monitors internal controls used in the achievement of service commitments and system requirements.
Background Checks
Background checks or their equivalent are performed before or promptly after a new hires start date, as permitted by local laws.
Code of Conduct
A Code of Conduct outlines ethical expectations, behavior standards, and ramifications of noncompliance.
Information Security Program Review
Management is responsible for the design, implementation, and management of the organization’s security policies and procedures. The policies and procedures are reviewed by management at least annually.
Disciplinary Action
Personnel who violate information security policies are subject to disciplinary action and such disciplinary action is clearly documented in one or more policies.
Cybersecurity Insurance
Cybersecurity insurance has been procured to help minimize the financial impact of cybersecurity loss events.

Vulnerability Management

Third-Party Penetration Test
A 3rd party is engaged to conduct a network and application penetration test of the production environment at least annually. Critical and high-risk findings are tracked through resolution.
Vulnerability and Patch Management Policy
A Vulnerability Management and Patch Management Policy outlines the processes to efficiently respond to identified vulnerabilities.

Risk Assessment

Risk Register
A risk register is maintained, which records the risk mitigation strategies for identified risks, and the development or modification of controls consistent with the risk mitigation strategy.
Risk Assessment
Formal risk assessments are performed, which includes the identification of relevant internal and external threats related to security, availability, confidentiality, and fraud, and an analysis of risks associated with those threats.

Network Security

Network Security Policy
A Network Security Policy identifies the requirements for protecting information and systems within and across networks.

Access Security

Removal of Access
Upon termination or when internal personnel no longer require access, system access is removed, as applicable.

Physical Security

Physical Security Policy
A Physical Security Policy that details physical security requirements for the company facilities is in place.

Communications

Privacy Policy
A Privacy Policy to both external users and internal personnel. This policy details the company's privacy commitments.
Communication of Security Commitments
Security commitments and expectations are communicated to both internal personnel and external users via the company's website.