Security
A client's therapy journal is not an ordinary dataset. Here is specifically how TherapiSync isolates it, who can reach it, and what happens if a device or an account is ever compromised.
Isolation between practices
Every client, and every journal entry that belongs to them, is scoped to an organization in the database itself, through row-level security — not through application code that has to remember a WHERE clause on every query. A bug in the portal cannot leak one practice's data into another's view.
Sync is one-directional, by grant
The database role the sync API runs as is only granted permission to insert and update a client's own journal records — it has no DELETE or write path back onto anything a practice controls. That direction is enforced by Postgres privileges, so it holds even if the application code above it has a bug.
Per-client access, revocable at any time
A practice sees exactly the clients who have actually linked their account to it, never a roster borrowed from another practice. A client who journals with two different practices keeps each one's view limited to their own link, and either side can end that link without the other's agreement.
Consent that starts and ends on the client's device
A client joins a practice by entering that practice's join code in their own app, after confirming the practice's real name shown to them — there is no account for anyone else to create on their behalf. They can unlink from a practice at any time, and can choose to have everything they sent deleted along with it.
Verified clinician accounts
A new office account must confirm its email address before normal use, by following a single-use link. Passwords are hashed with scrypt before they are stored; the plaintext password is never written anywhere and never kept in memory longer than the request that checks it.
Session and device tokens are opaque and single-use
Login sessions and device tokens are random values shown once. What the database keeps afterward is a SHA-256 digest of that value, not the value itself — a copy of the database does not hand over anyone's active session or a device's own token. A practice's join code is a public identifier rather than a secret, deliberately — the safeguard there is the confirmation step above, not secrecy of the code.
An audit trail that the application cannot edit
Logins, join-code activity, client-link changes, and data-deletion requests are written to an append-only log. The database role the application runs as has no UPDATE or DELETE grant on that table, so the record of what happened cannot be quietly edited by anything running inside the app.
Encrypted in transit, and a database that is not on the public internet
Connections to the portal and to the sync API are encrypted end to end. The database behind them is not exposed to the internet at all — the only thing reachable from outside is the application, which is the only thing permitted to reach the database.
Handling therapy journal data means practices using TherapiSync have their own obligations under HIPAA. See the Privacy Policy for how that responsibility is divided, or get in touch to report a security concern.