Trust
Security
Last updated May 31, 2026
Mentalys handles protected health information for psychiatric practices, so security is foundational rather than an add-on. This page summarizes the safeguards that protect your data. For contractual terms, see our Privacy Policy and Terms of Service.
01Encryption
- At rest: all data is encrypted with AES-256.
- In transit: all connections are protected with TLS 1.3.
Encryption covers session audio, transcripts, generated notes, and patient records — from the moment data reaches us through storage and retrieval.
02HIPAA compliance
Mentalys is built to meet the HIPAA Privacy and Security Rules. We operate as a Business Associate of your practice and maintain administrative, physical, and technical safeguards for PHI throughout its lifecycle.
03Audit logging
Every access is recorded
Every access to PHI is logged. Audit records capture who accessed which record and when, creating an accountable trail that supports investigation and HIPAA accounting-of-disclosures requirements.
04Access controls
- Practice-level isolation enforced by row-level security (RLS), so a practice can only ever reach its own data.
- 30-minute session lockout — idle sessions are locked automatically and require re-authentication.
- Device fingerprinting to detect and flag access from unrecognized devices.
05Business Associate Agreement
A Business Associate Agreement (BAA) is available to every customer and must be in place before PHI is added to the service. To request a BAA, contact judah@mentalys.ai.
06Data residency
All data is stored and processed within the United States only. Our subprocessors operate in U.S. regions; data does not leave the country in the normal course of operating the service.
07Availability
We target an uptime commitment of 99.9%. Our infrastructure is designed for redundancy and resilience so your clinical workflow stays available when you need it.
08Vulnerability disclosure
Responsible disclosure
If you believe you have found a security vulnerability, please report it to judah@mentalys.ai. We review every report promptly and will work with you in good faith to resolve valid issues. Please do not access or modify data that is not yours while testing.