BxScribe is built for clinical documentation, so the safeguards below apply to every account on every plan. This page lists the controls that are in place today.
Last updated: October 2, 2026
Technical safeguards
Encryption in transit
Every connection to BxScribe uses TLS (HTTPS). Session cookies are host-only, so the clinician app and each family portal keep separate sessions.
Encryption at rest
The database is encrypted at rest by our managed Postgres provider. Uploaded files are stored in Amazon S3 with server-side AES-256 encryption and are only served through short-lived signed links.
Verified sign-in and strong passwords
Email-and-password accounts must confirm their address before they can sign in. New passwords need at least 12 characters, and passwords found in known data breaches are rejected. After 10 failed attempts in 15 minutes an account is locked for 15 minutes. Password-reset links expire after one hour and resetting a password signs out every other session.
Two-factor sign-in
Anyone can add an authenticator-app code and backup codes to their password from Settings → Security, and can choose to trust a device for 30 days. Agency owners and admins can require two-factor sign-in for every member — members without it see none of the agency's data until they turn it on. BxScribe staff need it to use our internal console.
Automatic sign-out
After an hour without activity you are signed out, in every open tab, so an unattended screen doesn't keep showing client records. Every session also ends 24 hours after sign-in. You can see your signed-in devices and sign them out from Settings → Security.
Role- and assignment-based access
Each agency's data is separated at the query layer. Clinicians see only the clients actively assigned to them; owners and admins decide who else sees what, and billing staff never see note content. Suspending or removing a team member signs them out everywhere at once.
Tamper-evident audit log
Sign-ins, failed sign-ins, record views, changes, exports and team changes are written to a server-side audit log with the person, time and IP address. Exports are recorded before the file is created. The log is append-only and each entry is cryptographically chained to the one before it, so an edited or missing entry is detectable; the chain is checked daily. Entries are kept for seven years.
Access and disclosure report
For any client, agency owners, admins and compliance staff can see who viewed, changed, exported, released to the family portal, or sent that client's records for AI processing — and download it as a spreadsheet.
Full-record export
One click exports a client's complete record — notes with their versions and signatures, plans, assessments, data, documents, uploaded files and the access report — so an agency can answer a records request. The download link expires after 15 minutes.
Version history
Notes, treatment plans and assessments keep a version for every change. A finalized note can't be edited or deleted — corrections are made as amendments, so signatures keep matching what was signed.
Daily security review
Every day BxScribe checks the audit log's integrity and looks for unusual activity — bulk exports, someone opening far more clients' records than usual, accounts locked by failed sign-ins — and alerts the agency's owner, admins and compliance staff. The alerts contain no client information.
Data retention controls
Agency records belong to the agency and are never deleted on a timer. In a personal workspace you choose how long notes are kept (7 or 10 years, or indefinitely); a daily job removes personal notes past that period.
Deletion
When you delete your account, your sign-in and personal workspace are removed within 30 days, including uploaded files in storage. Records you created for an agency stay with that agency. A record of what was deleted is kept in the audit log.
Business Associate Agreements
An ABA agency is a HIPAA covered entity, and a vendor that stores its clinical records is a business associate. We are putting our own Business Associate Agreement and the agreements with our sub-processors in place; until that work is finished we don't offer a BAA. The current status of each vendor is on the sub-processors page. If your organization needs a BAA, tell us through the contact form (topic “HIPAA & BAA inquiry”) and we'll follow up when it is available.
AI processing
AI features send what they need to OpenAI: note drafting sends the session details you enter with the client's first name and relevant profile fields; dictation and live sessions send audio for transcription (BxScribe keeps the transcript, not the audio); document tools send the document's text. We ask OpenAI not to store responses where its API offers that setting, and OpenAI's API data policy applies. Every AI draft is a starting point that a clinician reviews, edits and signs; it does not replace clinical judgment.
Your responsibilities
Keep your password private and sign out on shared devices.
Give team members the least access their job needs, and remove people who leave.
Review AI-drafted content before you sign or submit it.
Don't put client information in support, feedback or contact messages — describe the problem instead.
Turn on two-factor sign-in, and require it for your agency.
Reporting a vulnerability
If you believe you've found a security vulnerability or a privacy issue, email security@bxscribe.com with enough detail for us to reproduce it. Please don't access other people's data or disrupt the service while testing, and give us a reasonable chance to fix the issue before disclosing it.
