Trust center
Trust & security
Clinical notes, calendar data and payment details are the most sensitive things a practice holds. Here is how Caresoft.ai protects them.
How your data is protected
Credentials are never stored in the clear
Passwords are kept only as bcrypt hashes. Nobody at Caresoft can read a password, and a database copy would not reveal one.
Connected accounts are encrypted at rest
Google Calendar tokens are sealed with AES-256-GCM before they are written. Sensitive billing identifiers are encrypted the same way and are never returned in plain text.
Clinical and financial records stay intact
Once an invoice is issued or a consent form is signed, that version is kept unchanged. Later edits create a new version rather than rewriting history.
Traffic is encrypted in transit
Every request between a browser and Caresoft runs over TLS, including patient portal sessions and payment pages.
Access follows the role
Every screen and every API route checks who is asking before it answers.
Psychologists and practice staff
See their own practice: its patients, calendar, notes and billing. One practice can never read another's records.
Patients
See only their own record through the portal — their appointments, assessments, documents and payments. Nothing from anyone else's care.
Working with your compliance programme
Frameworks such as HIPAA, SOC 2 and PCI DSS cover an entire deployment, not a single vendor — your devices, your staff and your processes count as much as the software. Caresoft.ai is built to hold up its side of that:
- Minimum-necessary access enforced by role, with encryption in transit and at rest
- Business Associate Agreements available for practices that need one
- Security questionnaires and vendor reviews answered directly by our team
Preparing for an audit or a review? Get in touch and we will share what your assessor needs from our side.