Security

Every account is authenticated through a managed identity provider supporting email and password plus Google sign in. Roles for members, practitioners and internal staff are stored separately from profile records so a role cannot be self assigned. Sensitive internal fields such as compensation and licensing are restricted to internal roles and are not exposed to practitioners or members.

All traffic is served over HTTPS. Data sits in a managed Postgres database with access rules on every table, evaluated as the signed in user rather than trusted from the browser. Privileged operations run in server code that verifies the caller's session first. Automated database backups run on a schedule.

API credentials for scheduling, email and AI are held as server side secrets. Inbound webhooks verify a signature before processing.

Changes ship through a reviewed build with automated type checking and an accessibility and rendering gate that must pass before a change is accepted. Automated security scanning runs against the database configuration and dependencies, and findings are triaged rather than queued indefinitely.

If we discover a breach affecting personal data we will investigate, contain it, and notify affected members and organisation buyers together with what we know and what we are doing. We will not delay notification to finish the investigation first.

• We are not a HIPAA covered entity and this platform is not a substitute for medical care.
• We do not hold SOC 2, ISO 27001, or any independent security certification today.
• We do not describe ourselves as GDPR, HIPAA or PCI certified.
• We do not claim that anyone monitors your entries as you write them. Nobody does.
• We do not claim your data stays in your own country.

Email privacy@rebuildingthoughts.com with enough detail to reproduce the issue. Please do not access, modify or retain other people's data while testing. We will acknowledge you, keep you updated, and will not pursue anyone who reports in good faith.