Privacy first.
Security always.
We never sell your data or share it with advertisers.
TrustRoom is HIPAA compliant and FERPA-ready, and runs on Google Cloud infrastructure that holds current SOC 2 Type II and ISO 27001 certifications.
01 / Privacy
Your data stays yours.
Your notes, journals, and messages belong to your practice. They are never sold, shared with advertisers, or used to train public AI models.
Technical details
Business Associate Agreements
Every practice accepts our BAA at signup. Our core platform and AI processing run on Google Cloud under a signed BAA, and our speech-to-text vendors process audio under their own BAAs.
Private by design
Built for the therapeutic relationship.
- Your practice owns its data
- No advertising or data sales
- No training of public AI models
02 / Access
The right access. For the right people.
Role-based permissions limit access to client information. Providers can use two-step sign-in, which is required for practice admins. Activity on client records is recorded in an audit trail.
Technical details
Access Controls & MFA
Role-based access controls, with two-step sign-in (authenticator app or text message) for provider accounts, always required for practice admins. The client app offers a Face ID or Touch ID lock.
HIPAA Audit Logging
Audit logs of activity on client records, which users can’t change or delete.
Access with accountability
Protection around every client record.
- Permissions based on role
- Two-step sign-in available
- Audit logs users cannot alter
03 / Protection
Protected at every layer.
Encryption protects information in transit and at rest. Backups and a documented response plan support the continuity of your practice.
Technical details
Encryption at Rest & in Transit
Data we store in Google Cloud is encrypted at rest with AES-256. Every connection uses HTTPS, and our web app accepts only TLS 1.2 and 1.3. Card payments are processed by Stripe, a PCI DSS Level 1 certified provider, and card numbers never reach our servers.
Infrastructure Security
Hosted on Google Cloud under a signed BAA. Google Cloud holds current SOC 2 Type II and ISO 27001 certifications. Production runs in its own project, with point-in-time recovery and daily backups.
Incident Response
A documented incident response plan. If a breach affects your clients’ information, we notify your practice within 30 days of discovery, as our BAA requires.
Layers of protection
From connection to storage.
- HTTPS connections
- AES-256 encryption at rest
- Backups and recovery planning
Transparency
The details, in writing.
Review our policies and agreements, or get in touch with a security question.
FAQ
No. We never sell your data. Your information is never sold, shared with advertisers, or used for marketing purposes, and it is never used to train public or third-party AI models.
Our core platform runs on Google Cloud under a signed Business Associate Agreement, and data we store there is encrypted at rest. Google Cloud maintains current SOC 2 Type II and ISO 27001 certifications.
Not yet. Google Cloud, which runs our infrastructure, holds current SOC 2 Type II and ISO 27001 certifications. We would rather tell you exactly where we are than imply a certification we do not hold.
You do. Patients can request a full copy of their records at any time, and providers receive complete data exports on offboarding.
We collect account information and the clinical, scheduling, and billing information needed for the features you use. Clients may also choose to share supported sleep, exercise, and resting-heart-rate data through Apple Health or Google Health Connect on Android. Health sharing requires their permission and is optional. See our Privacy Policy for the full details.
No. Session audio is transcribed and then permanently deleted from our systems automatically, with a storage lifecycle rule that purges any residual file within 7 days as a backstop. The raw transcript is deleted once your clinical note is generated, unless you choose to keep it. We do not retain audio to train or tune AI models, and we never create voiceprints or other biometric identifiers from it.
Data we store in Google Cloud is encrypted at rest with AES-256, and every connection uses HTTPS; our web app accepts only TLS 1.2 and 1.3. Access is role-based, activity on client records is written to audit logs that users can't change or delete, and provider accounts can use two-step sign-in, which is always required for practice admins.
Care doesn't end when the session does
That's where it begins.
Join the therapists using TrustRoom to stay connected to their clients between sessions.
Get started for free