Security & compliance
Where we stand.
What we hold, how we protect it, and where we are on independent verification. This is the short version of what we walk your IT team through.
Data
Workforce records, not patient records.
Our products hold hours, supervision, licenses, milestones and approvals. None of them store clinical information. If an engagement ever needs protected health information, we sign a BAA before any of it reaches our systems, and our subprocessors are covered in turn.
Infrastructure
Encrypted, isolated, recoverable.
Hosted in a single US AWS region. Applications run in private containers, and the database sits in an isolated subnet with encryption at rest, automated backups and point-in-time recovery. Infrastructure is defined in code, and every change ships through a reviewed deploy.
Access
Your staff sign in with your identity provider.
Single sign-on over SAML or OIDC, role-based access so people see only what their job needs, and an append-only audit log of every approval. We never need write access to your systems.
In practice
What this looks like operationally.
- Encryption everywhere. Data is encrypted in transit and at rest across the systems we build and operate.
- Least-privilege access. Role-based controls mean people see only what their job requires, and every access is logged.
- Metadata-only logging. Logs record who did what and when, not the contents of the records.
- Your data stays yours. Full export at any time, and at the end of a contract. Where we use AI for back-office drafting or summaries, it makes no decisions about care, eligibility or payment, and customer data is never used to train a model.
- Breach response. Documented procedures for detection, notification and remediation, aligned with HIPAA breach-notification requirements.
What comes next.
- Independent security review. A third-party penetration test and security review before go-live.
- SOC 2. A Type I report before our first production deployment, then Type II within its first year.
Regulatory note: depending on services and funding, behavioral health organizations may also be subject to 42 CFR Part 2 protections for substance-use-disorder records. We design with Part 2 in mind and scope it explicitly during onboarding.
If your IT or compliance team has a questionnaire or specific questions about how data flows through our systems, send it over and we’ll walk through it.