Security
Your practice data, protected
Your clients trust you with sensitive information, and you can trust Soap Notes to keep it safe. Here’s how we protect your data.
Encrypted in transit and at rest
Your data is encrypted as it travels to and from the app and while it's stored, so it stays protected end to end.
Role-based access
Access is controlled by role, so only the right people on your team can see sensitive client information.
A portal you control
Clients see only what you choose to share through their portal. Your clinical notes stay private by default.
Secure payments
Payments are processed through Stripe, a PCI-compliant provider, so card details are handled securely and never stored by us.
Backed up and reliable
Your records are stored on reliable cloud infrastructure and backed up, so they're protected against loss.
Industry-standard practices
We apply industry-standard security practices and review them regularly as the product grows.
Your data is yours
We don’t sell your data, and we don’t get in the way of it. Your notes and client records belong to you, Soap Notes is simply the secure place you keep them. If you ever have a specific security or compliance question for your practice, get in touch and we’ll be glad to help.
For practices in the United States
If you practice in the United States, here is what is in place today for your client records.
- Your data is hosted in the United States, on Amazon Web Services in the us-east-1 region.
- Data is encrypted in transit and at rest.
- Access is role-based, so each person sees only what their role allows.
- An audit log records who created, edited or deleted notes, and when.
- Backups are encrypted.
- We have a named privacy officer you can reach at privacy@soapnotes.online.
If your practice needs a Business Associate Agreement, contact us and we will discuss what we can offer.
Service providers that store or process your data
- SupabaseDatabase (United States)
- RenderAPI hosting (United States)
- VercelWeb hosting
- StripePayments
- GoogleSign-in, and the optional Calendar, Meet, Gmail and Drive integrations
- PostHogProduct analytics
- CloudflareEncrypted backups
Security FAQ
Run your practice with confidence
Notes, scheduling, invoicing, and a secure client portal in one place. Free for solo practitioners, no credit card required.