How we protect your practice

Encryption

• All traffic is served over HTTPS (TLS 1.2+).
• Your journal, voice transcripts, and layer entries are encrypted at rest on managed infrastructure.
• Passwords are never stored — only salted bcrypt hashes.

Isolation

• Every table holding user content has row-level security (RLS) enabled. You can only read and write your own rows — enforced in the database, not just in the app.
• Service-role keys are server-only. They are never present in the browser bundle.
• Sensitive operations (auth, payments, account deletion) run through server functions with explicit auth middleware.

Sub-processors

We use a small number of vetted sub-processors. Each handles a single, narrow function:

• Managed cloud backend (EU-hosted Postgres) — database, auth, file storage. EU/US region depending on workspace.
• Cloudflare — edge delivery, TLS, DDoS protection.
• Resend — transactional email (sign-in, account, support replies). No marketing email.

No third-party analytics, no advertising pixels, no session-replay tools. Ever.

Access controls

• Only two people have production database access. Both use hardware-backed MFA.
• All admin actions are logged with an actor and timestamp.
• You can delete your account and all associated content at any time from Settings → Account.

Incident response

If a security incident affecting your data occurs, we will notify affected accounts by email within 72 hours of confirmation, in line with GDPR Article 33. The notice will describe what happened, what data was involved, and what we are doing about it.