EMDR Assist is built for licensed therapists. That means protected health information has to be safe — by design, not by promise. Here's how.
Built with privacy-first design. We encrypt data at rest and in transit, enforce row-level isolation, and maintain audit logs for all sensitive actions.
TLS 1.2+ in transit. AES-256 at rest for the database, file storage, and backups. Keys are managed by our cloud provider's HSM.
Row-level security in the database ensures one therapist can never see another therapist's clients, sessions, or notes — even via the API.
The product is built so therapists don't need to enter legal names, dates of birth, or contact info. Pseudonyms are expected. Free-text fields are automatically scrubbed for emails, phone numbers, and SSNs.
Sensitive actions on clinical data — writes, deletes, role changes, and account events — are recorded to an append-only audit log that admins (not other users) can review. Update and delete are revoked at the database level.
Optional time-based two-factor authentication with an authenticator app, which you can turn on in your security settings.
Hosted in SOC 2 Type II audited data centers. We do not run on-premise servers. We maintain a subprocessor inventory, and Business Associate Agreements are signed or in progress with every provider that handles clinical data.
If a breach affects your data, we notify affected users and HHS within 60 days, consistent with §164.404–410.
Automated database backups with a documented retention window.
Export your records any time. Request account deletion and we purge within 30 days, including backups within the documented retention window.
We welcome responsible disclosure. Email our security team and we'll acknowledge within 2 business days.
security@emdrassist.comFull technical detail: Security statement · Privacy policy · Terms