Is themednet.org safe to use as a vendor?

themednet.org scored 57/100 on LynxRadar's security posture assessment. The domain has significant security gaps that should be addressed. 5 checks passed, 2 warnings, 3 critical issues across 10 passive checks including TLS, DMARC, security headers, breaches, and CVEs.

What TLS version does themednet.org use?

themednet.org uses TLSv1.3 with TLS_AES_128_GCM_SHA256. TLSv1.3 negotiated with TLS_AES_128_GCM_SHA256 (128-bit). Strong configuration with no deprecated protocols or weak ciphers detected.

Does themednet.org have DMARC configured?

Yes. themednet.org's DMARC policy is set to 'reject'. SPF record: yes. Strengths: DMARC policy set to reject (strongest); SPF record present with hard-fail (-all); DKIM configured (selectors: google, s1, s2, k1, mandrill).

Does themednet.org have SPF configured?

Yes. SPF record: v=spf1 include:spf.mandrillapp.com include:_spf.google.com -all

Does themednet.org have security headers configured?

themednet.org has 0 of 5 recommended security headers. Missing: CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy.

Has themednet.org been involved in a data breach?

No known breaches found. No known breaches found in public disclosure databases.

themednet.org Security Report — Grade F (57/100)

Q: Does themednet.org use HSTS?

No. Strict-Transport-Security header is missing. Connections can be downgraded to HTTP via man-in-the-middle attacks.

Q: Does themednet.org have known CVE vulnerabilities?

Detected technologies: Apache/2.4.54, Proxy/CDN. (Proxy/CDN detected but excluded from CVE matching — upstream infrastructure). 1 critical-severity CVE(s) found (CVSS >= 9.0): CVE-2022-36760. Immediate patching recommended.

Q: Is themednet.org's SSL certificate valid?

Issues detected. Strengths: Issued by Amazon. Issues: Certificate expires in 28 days — renewal recommended; Wildcard certificate in use — broader attack surface if compromised.

Q: Does themednet.org have DNSSEC enabled?

No. Strengths: 4 nameservers configured (ns-1525.awsdns-62.org., ns-1984.awsdns-56.co.uk., ns-241.awsdns-30.com., ns-771.awsdns-32.net.); 5 MX records present; Zone transfers properly restricted. Issues: DNSSEC not configured — DNS responses can be spoofed.

Trust rating

Fail · 57/100

Procurement snapshot

0 critical findings identified — these point to architectural gaps, not just configuration tweaks.

Strengths

TLS Configuration

Known Breaches

DMARC / Email Security

MX Records & Mail Provider

Questions to ask

Confirm DNSSEC rollout timeline

Estimated remediation effort: 1–2 days

Based on a passive external scan — supplement with vendor-provided attestations, not a replacement.

Trust Score Trend

→ No change 1 scan · Last scanned February 18, 2026

Your rating Industry average

Score

100 75 50 25 0

themednet.org

57/100

Compliance & Certifications

Not yet verified

HIPAA

BAA not on file

Self-reported

Pro subscribers only

HITRUST

Certificate not on file

3rd party

Pro subscribers only

SOC 2 Type II

Audit report not on file

3rd party · AICPA

Pro subscribers only

Incident History

None in 12 months

March 2026

ChatGPT data exposure

1 source

Resolved

Pro subscribers only

April 2023 – Feb 2026

ChatGPT data exposure

1 source

Resolved

Pro subscribers only

Security Posture

5 items need attention

5 passed

Turn on HSTS (forces browsers to always use HTTPS)

HSTS Header

< 1 hour

This puts visitor logins and session data at risk of interception on untrusted networks. themednet.org doesn't send the HSTS header, so a browser can still be tricked into connecting over plain, unencrypted HTTP instead of HTTPS — an attacker on the same network (e.g. public wifi) can exploit that gap to intercept traffic. Turning HSTS on tells every browser "always use HTTPS for this site, no exceptions."

PCI-DSS 4.0Req 6.4.1

Required application security controls

NIST 800-53SC-8

Transmission confidentiality and integrity

How to fix this

1Add this response header to your site. You're using Amazon CloudFront in front of this site — add it there, see https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/creating-response-headers-policies.html.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

2Before adding it, make sure every subdomain (not just the main site) also works over HTTPS — HSTS applies site-wide.

3Confirm it's live: search "http header checker" and enter themednet.org.

4Once confirmed, submit the domain at hstspreload.org so browsers enforce HTTPS even on a user's very first visit.

HSTS guide

Report unlocked.

View all 5 passed checks

TLS Configuration

Known Breaches

DMARC / Email Security

MX Records & Mail Provider

Subprocessors & Tech Stack

Company Signals

Claim profile →

Operational risk

Low

11 yrs operating. Well-funded

Lynxradar · Composite signal

Last funding

$40B

Series F · Mar 2025 · SoftBank-led

Crunchbase ↗

Employees

~3,000

+40% YoY growth

LinkedIn ↗

Trust Resources

Claim profile →

Trust Center

trust.themednet.org ↗

Security page

themednet.org/security ↗

themednet.org/privacy ↗

DPA (Data Processing Agreement)

themednet.org/dpa ↗

Updated recently

Subprocessors List

themednet.org/policies/subprocessors ↗

Tech Stack Detected

Subprocessors

Amazon CloudFront

Similar companies in Healthcare / Health Tech

Appears in

Claim profile →

SOC 2 Type II certified vendors

847 companies · Updated weekly by LynxRadar

Track

ISO 27001 certified SaaS

312 companies · Updated weekly by LynxRadar

Track

Top AI vendors by trust score

94 companies · LynxRadar ranking

Track

Enterprise-ready SaaS · Trust score A or above

203 companies · LynxRadar ranking

Track

Blocking Issues

Not enabled

Strict-Transport-Security header is missing. Connections can be downgraded to HTTP via man-in-the-middle attacks.

Likelihood: ★★★☆☆

Impact: ★★★★☆

0/5 present

Missing: CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy

Likelihood: ★★★☆☆

Impact: ★★★☆☆

Issues found

Detected technologies: Apache/2.4.54, Proxy/CDN. (Proxy/CDN detected but excluded from CVE matching — upstream infrastructure). 1 critical-severity CVE(s) found (CVSS >= 9.0): CVE-2022-36760. Immediate patching recommended.

Likelihood: ★★★★☆

Impact: ★★★★★

Medium Priority

Not enabled

Strengths: 4 nameservers configured (ns-1525.awsdns-62.org., ns-1984.awsdns-56.co.uk., ns-241.awsdns-30.com., ns-771.awsdns-32.net.); 5 MX records present; Zone transfers properly restricted. Issues: DNSSEC not configured — DNS responses can be spoofed.

Likelihood: ★★☆☆☆

Impact: ★★★☆☆

Issues

Strengths: Issued by Amazon. Issues: Certificate expires in 28 days — renewal recommended; Wildcard certificate in use — broader attack surface if compromised.

Likelihood: ★★☆☆☆

Impact: ★★☆☆☆