BAA included
Every practice signs SyncedUp's business associate agreement before keeping client records here. It commits us to report incidents within five business days and breaches within 15 days, faster than the law requires.
Security
Your clients' records, protected like they should be.
SyncedUp Therapy is built for the privacy rules therapists work under. Here is exactly what protects your clients' records, in plain language.
- BAA includedSigned right in the app
- Built for HIPAASecurity Rule safeguards
- EncryptedAES-256 at rest, TLS in transit
- SOC 2 Type 2 hostingAWS and Vercel, independently audited
- HITRUST emailClient email through Paubox
- US data centersRecords and backups stay in the US
- Full audit trailEvery record view logged
- Two-step sign-inAuthenticator app protection
- Backed up every 6 hoursSecond-region copies, restore tested
- Threat detectionAlways-on monitoring and alerts
- Never soldNever used to train AI
What each one means.
Built for HIPAA
Administrative, physical and technical safeguards under the HIPAA Security Rule: a written risk analysis, access controls, audit logs, encryption, backups and a breach response plan.
Encrypted
Client records, files and backups are encrypted at rest with AES-256, and every connection uses TLS 1.2 or newer with HTTPS enforced.
SOC 2 Type 2 hosting
SyncedUp runs on Amazon Web Services and Vercel. Both hold SOC 2 Type 2 reports from independent auditors, and both have signed business associate agreements with us. SyncedUp itself does not have its own SOC 2 report yet.
HITRUST email
Reminders, receipts and portal links go to clients through Paubox, a HIPAA email service with HITRUST r2 certification and a signed business associate agreement.
US data centers
Your client records, uploaded files and every backup are stored in data centers in the United States.
Full audit trail
Every time someone opens a client's chart, notes, messages, invoices or superbills, it is recorded, along with important actions like signing a note or recording a payment. Nobody can edit or delete the audit trail.
Two-step sign-in
Turn on an authenticator app for your account, and require it for everyone in your practice. Idle sessions sign out automatically.
Backed up every 6 hours
The database is backed up every six hours, with daily snapshots and automatic copies in a second US region. Restores are tested, and we get an alert if a backup fails or none has finished in eight hours.
Threat detection
Automated threat detection watches our infrastructure around the clock, and every administrative action is recorded and kept for six years.
Never sold
We never sell your data or your clients' data, never use it for marketing, and never use it to train artificial intelligence. Our team does not look at client records unless you ask, to fix a security problem, or when the law requires it.
Straight answers
Certifications, honestly.
Is SyncedUp "HIPAA certified"?
No one is. The government does not certify software as HIPAA compliant, so any "HIPAA certified" seal is a marketing badge, not an official status. What counts is a signed business associate agreement and the safeguards behind it. You get both.
Do you have SOC 2?
Our hosting does. Amazon Web Services and Vercel, where your records live and the app runs, both hold SOC 2 Type 2 reports from independent auditors. SyncedUp itself does not have its own SOC 2 report yet, and we will say so on this page when that changes.
Who else can see client records?
Only the outside services that need them to run the product, each listed with its agreement status on our subprocessors page. Every service that stores or carries client records has signed a business associate agreement with us. An optional feature that uses a service without one, like AI drafting today, is marked there and only runs when you choose to use it.
What happens if something goes wrong?
We follow a written breach response plan. Our agreement commits us to tell you about an incident within five business days and about a breach within 15 days, faster than the law requires, so you can meet your own duties.
Questions from your compliance team?
Email support@syncedupsolutions.com. Read more on our privacy page and terms.
Get ready to open your practice.
We’re preparing SyncedUp Therapy for launch. Join the waitlist and we’ll let you know when registration opens.
No account or payment is required to join the waitlist.