Security your review team can actually evaluate
People share sensitive things with their Peer Coach. Protecting that information is foundational to how Chaperone is built and operated: encryption in transit and at rest, least-privilege access with a record of who did what, a single governed path for every AI request, and production isolated from everything else. Every control described below is one that is in place today.
Defense in depth, written for the people doing the diligence
This page is a buyer- and procurement-level overview of how we protect data: what we encrypt, who can access what, what we log, and how we manage the vendors and infrastructure beneath the platform. It describes controls that are operating in production. Where a control is not in place yet, this page says so rather than implying it — see what we don’t claim.
The headline controls, in one view
A fast orientation before the detail below, useful for an initial security questionnaire pass. Four facts, each verified against the deployed production system.
Encrypted in transit, encrypted at rest, minimized by default
We treat behavioral-health information as the most sensitive data we hold. Protection starts with strong encryption and continues through data minimization, isolation between environments, and keys held by our infrastructure providers rather than by application code.
We collect what is needed to provide and improve support, and no more. Production data is kept separate from non-production environments.
- Encryption in transit on every production connection
- Encryption at rest across our managed database and file storage
- Encryption keys managed by our infrastructure providers
- Secrets held in encrypted, environment-scoped storage, strictly separated between production and non-production
- Data minimization: collect only what support requires
- Production isolated from non-production environments
- Backups encrypted, with point-in-time database restore
Least privilege, by role, with a record of who did what
Access to sensitive data is scoped to the people who need it for their role and recorded so it can be reviewed.
Role-based access
Permissions are granted by role under a least-privilege model, enforced in the application by policy. Row-level-security policies are additionally defined on member-data tables and are verified continuously in our test pipeline; they are being enabled environment by environment as a second layer.
Strong authentication
Access to production infrastructure and administrative consoles requires multi-factor authentication, and workforce accounts are enrolled in multi-factor authentication.
Audit records
Chaperone maintains audit records for sensitive administrative and member-data actions to support accountability and investigation. Audit access and retention are governed by security controls.
Joiner / mover / leaver
Access is provisioned on a need-to-know basis and revoked when roles change or people leave. Role assignment, revocation, and temporary elevated access are administrative actions, and elevation requires a written justification and an expiration.
Environment isolation
Production runs on separate application and database infrastructure from non-production, with separate credentials, secrets, and session state. Releases are deliberately promoted rather than flowing automatically out of development.
People, not surveillance
Access controls protect data and accountability. They are not used to monitor the people we support. Oversight stays focused on safety and quality.
- Platform, application, and database activity logged by our hosting and database providers
- Sensitive administrative and member-data actions additionally captured in audit records
- No application errors, transcripts, or support content sent to third-party error-monitoring or session-replay services
- Access-control and row-level-security suites run in our build pipeline on every change
- Dependency vulnerability alerts and automated security updates on our code repository, with a secret-scanning step that blocks a committed credential before merge
- Documented information-security incident-response process, separate from member-safety escalation
A record of what happened, and a plan for when something goes wrong
Platform, application, and database activity is logged by our hosting and database providers and reviewed during incident response. Sensitive administrative and member-data actions are additionally captured in the audit records described above, which support accountability and investigation.
We do not send application errors, transcripts, or other support content to third-party error-monitoring or session-replay services. Logging is oriented toward the security and reliability of the systems, not toward watching the people who use Chaperone for support.
We do not operate a centralized security-monitoring pipeline or automated alerting on access patterns today, and we don’t describe one here. See what we don’t claim.
Our security extends to the partners beneath the platform
We hold our infrastructure providers and subprocessors to the same expectations we hold ourselves, and we are explicit about which of those agreements are signed and which are still in progress.
Audit status
Our security controls are implemented and operating, and the environment is built to be audited. No independent SOC 2 audit has been conducted, so we make no SOC 2 claim and there is no report to share. What we can do today is walk your reviewers through the controls themselves.
Bring us your questionnaireHIPAA-informed
We operate under a HIPAA-informed posture, including business associate considerations and safeguards for protected health information.
See HIPAA postureSubprocessor diligence
Service providers are evaluated on the nature of the information they process and the role they perform, credentials are scoped by environment, and integrations receive only what their function requires. Providers handling sensitive information are subject to contractual privacy, confidentiality, security, retention, and deletion requirements as those agreements are completed.
Responsible AI controls
Every AI request leaves through one governed egress path — no application code calls a model provider directly, and a lint rule in our build pipeline enforces it. Requests to our primary provider carry a provider-level instruction excluding providers that log or train on prompts, applied by default rather than left to individual developer choice.
Read our AI guardrailsPrivacy by design
Security and privacy are designed together. Data handling follows minimization, consent, and role-based access principles end to end.
Understand privacySafety & escalation
Security supports safety. Clear protocols connect people to appropriate resources, including crisis services like 988, when a moment needs more.
See safety protocolsThe controls we don’t have yet, named by us first
A trust page is only worth reading if the absences are in it too. These are the controls a reviewer would reasonably ask about and that we do not have in place today. We would rather you hear it here than find it in a questionnaire.
Each one is tracked internally with an owner. When a control becomes real, this page changes — and the claim is verified against production before it is published, not after.
- No SOC 2 claim. Chaperone is not SOC 2 compliant or SOC 2 certified, is not in a formal SOC 2 audit, and no SOC 2 report exists. We will not make a SOC 2 statement until one is factually established.
- No completed penetration test. Independent testing is being procured and has not yet been performed, so there is no report to share.
- No centralized monitoring or access alerting. Provider logs exist and the audit trail records sensitive actions, but we do not run a central security pipeline or automated alerting on unusual access.
- No published recovery objectives or restore-test record. Backups are encrypted and point-in-time restore is available; we have not published recovery targets or a restore-test schedule, so we do not assert them.
- Encryption, stated precisely. Data is encrypted in transit and at rest with keys managed by our infrastructure providers. We do not describe it with any stronger encryption claim than that, because a stronger one would not be true.
Reviewing Chaperone? Bring your questionnaire to a person.
Our security team works directly with procurement and information-security reviewers. We can complete vendor security questionnaires, walk through our controls, and answer the questions this page leaves open — including the ones about controls we don’t have yet.
What we can support during your review
- Completed vendor security questionnaires
- Control walkthroughs with our security team
- A written description of our control environment, and a straight answer on what is not in place yet
- Business associate and data-handling discussions
For general contact details, see our contact page.
Have a security review underway?
Bring your questionnaire, your timeline, and your team. We’ll walk through our posture and get your reviewers what they need.