Security & compliance
Mental health data is the most sensitive personal data there is. We treat it that way from the architecture up — not as a checklist applied at the end.
BAAs on file with all subprocessors. Customer-facing BAA offered to all US clinics. Encryption, access control, audit log, minimum-necessary access.
Article 28 DPA. EU data stays in EU regions. DPIA published for AI processing. Right to access, rectify, erase, and port — automated, not email-driven.
APP 1–13 compliant. Notifiable Data Breaches scheme. AHPRA / PsyBA practice standards surfaced in intake-consent flows.
Technical controls
TLS 1.3 only on public endpoints; HSTS preload.
AES-256 with per-tenant KMS data-encryption keys.
Free-text clinical fields and transcripts encrypted with per-tenant keys — cloud admin alone cannot read them.
Postgres RLS enforces tenant isolation in every query.
Append-only, partitioned monthly, retained 7 years immutable.
MFA required; sensitive operations re-prompt.
Private program with disclosure SLAs.
Third-party engagement with remediation tracked.
Data residency
You pick your region at signup. Data for your practice physically stays there. Cross-region transfers for PHI are never used.
EU
Primary: eu-west-1
DR: Frankfurt fallback
US
Primary: us-east-1
DR: us-west-2 DR
Australia
Primary: ap-southeast-2
DR: ap-southeast-4 DR
Certifications & attestations
Where each programme stands today. We publish status honestly so procurement teams know what's on file and what's still to come.
Annual risk assessment on file, signed BAAs with every subprocessor, customer-facing BAA on request for US practices.
Published Data Protection Impact Assessment covering PsycheNote AI — lawful basis, retention, and opt-out.
Auditor engaged; control evidence collection underway, with a target report by Q4 2026.
Starts immediately after Type I — continuous evidence collection via our control-monitoring stack.
Planned in parallel with SOC 2 Type II to support EU and APAC enterprise procurement.
Pursued when we onboard our first NHS trust. Aligned with existing GDPR and DPIA controls.
Roadmapped for UK enterprise readiness — most controls already overlap our security baseline.
Need our security pack for procurement?
SIG Lite, CAIQ, pen-test summary, subprocessor list, and BAA / DPA templates available on signed NDA — usually within 48 hours.
Questions about our security posture? Email security@psycheassess.com.