Security

Security contact

For vulnerability reports, security concerns, BAA requests, and security questionnaires, contact us through your Unfold account. We aim to respond within one business day.

Compliance posture

HIPAA

Session recordings, transcripts, and notes may include PHI. Unfold is designed for clinical workflow and applies administrative and technical safeguards intended to protect that data. Do not submit PHI until a Business Associate Agreement is in place. A BAA, when executed, governs PHI and takes precedence over conflicting terms.

SOC 2

Unfold is not SOC 2 certified at this time. No claim of certification will be made prior to issuance of an audit report.

Infrastructure

1. Application hosting and data stores. The application runs on modern cloud infrastructure. Session audio and structured data are stored with Supabase.
2. Encryption in transit. TLS on public endpoints.
3. Tenancy. Multi-tenant application with logical isolation per Customer account.
4. Audio retention. Session audio is deleted from storage as soon as transcription and notes finish. Unprocessed leftover audio is removed after 7 days. Transcripts, notes, and briefs are kept so you can continue clinical workflow after audio is gone.
5. Automatic deletion. Clinicians can choose, at setup or later in Settings, to have sessions and their transcripts, notes, and briefs permanently deleted 30, 90, or 180 days, or 1 year, after a Client was last seen. It is off by default, and changes take effect after a 24-hour grace period.

Authentication and access

1. Sign-in. Passwordless login via one-time passcode delivered to a verified email address. Reusable passwords are not stored by Unfold.
2. Account isolation. Customer Data is scoped to the signed-in therapist account.
3. Least privilege internally. Access to production systems is limited to what is required to operate and support the Services.

AI and subprocessors

Unfold uses third-party services for authentication, hosting, transcription, AI drafts, text-to-speech, and email. We do not use Customer Data to train our own AI models. Names and personal relationships are replaced with placeholders before draft generation, before the assistant reads records, and before transcript passages are indexed for search. The assistant only drafts changes (emails, agendas, notes); nothing is sent or saved until the clinician approves it. Audio is sent for transcription in short clips, then deleted from storage. Current subprocessors include:

1. Clerk — authentication;
2. Supabase — database and file storage;
3. Deepgram — speech-to-text;
4. OpenAI — draft notes, briefs, the assistant, transcript search, and related AI features;
5. ElevenLabs — text-to-speech when you listen to a pre-session brief (audio is streamed, not stored);
6. Resend — transactional email, including Client summaries you choose to send.

Application security

1. Production changes are reviewed before they ship;
2. Secrets are kept out of source control;
3. Signed, time-limited URLs are used when audio must be retrieved for playback or processing.

Responsible disclosure

If you identify a vulnerability in Unfold, please report it through your account contact channel. Include a description of the issue, the affected asset, steps to reproduce, and any supporting evidence.

Do not access, modify, retain, or disclose PHI or personal data belonging to other users. If you encounter PHI while testing, stop immediately and report. Do not perform testing that disrupts service to other users, and do not exfiltrate data — a proof of concept is sufficient.

Incident response

Security incidents are investigated promptly. Where an incident affects Customer Data, we will notify affected Customers as required by any BAA and applicable law.

Current gaps

We disclose the following gaps in the current program:

1. SOC 2 report: not yet available;
2. Independent penetration test: planned; not yet published;
3. Public paid bug bounty: not currently offered.

This section is updated as status changes.

Privacy

Collection, use, and disclosure of personal information are described in the Privacy policy. The Terms of service govern use of the Services. To the extent of any conflict regarding PHI, a BAA controls.