Your data security is our top priority
Enterprise-grade security and full HIPAA compliance to protect your practice and your clients.
Certifications & Compliance
HIPAA Compliant
Full compliance with HIPAA Privacy and Security Rules
SOC 2 Type II
Independently audited security controls
HITRUST CSF
Healthcare security framework certification
BAA Available
Business Associate Agreements for covered entities
How We Protect Your Data
Encryption at Rest
All data is encrypted using AES-256 encryption when stored in our systems.
Encryption in Transit
All data transfers use TLS 1.3 encryption to protect against interception.
Access Controls
Role-based access controls ensure users only see data they're authorized to access.
Audit Logging
Complete audit trails of all data access for compliance and security monitoring.
Multi-Factor Authentication
Optional MFA adds an extra layer of protection to your account.
Automatic Backups
Continuous backups ensure your data is never lost.
Infrastructure Security
Our infrastructure is designed for security from the ground up.
Cloud Hosting
Hosted on AWS with SOC 2 and HIPAA-compliant infrastructure
Network Security
Firewalls, intrusion detection, and DDoS protection
24/7 Monitoring
Continuous security monitoring and alerting
Penetration Testing
Regular third-party security assessments
Incident Response
Documented procedures for security incident handling
Disaster Recovery
Redundant systems and tested recovery procedures
AI Safety & Privacy
Our AI features are designed with privacy and safety as core principles.
No Training on Your Data
Your client data is never used to train AI models. Ever.
Human Review Required
All AI-generated content requires clinician review before saving.
Consent Management
Built-in tools to document client consent for AI features.
Transparency
Clear labeling of AI-generated content in all records.
HIPAA Compliance
We take HIPAA compliance seriously. Here's how we meet our obligations.
Administrative Safeguards
Security policies, employee training, and designated security officer
Physical Safeguards
Secure data centers with controlled access
Technical Safeguards
Access controls, encryption, and audit controls
Business Associate Agreements
BAAs signed with all covered entity customers
Breach Notification
Procedures for timely notification in case of breach
Risk Assessments
Regular assessments to identify and address risks
Security FAQ
Yes, Therapal is fully HIPAA compliant. We sign Business Associate Agreements (BAAs) with all covered entity customers and implement all required safeguards.
All data is stored in HIPAA-compliant AWS data centers in the United States.
No. We never use your client data to train AI models. Our AI is trained only on de-identified, publicly available clinical literature.
We have documented incident response procedures. Affected customers will be notified within 24 hours of discovering a breach, as required by HIPAA.
Yes, our SOC 2 Type II report is available to customers and prospects upon request. Contact security@therapal.io.
Questions about security?
Our security team is happy to answer your questions and provide documentation.