How We Protect Your Data

Supervision records contain sensitive professional information. Performance assessments, competency evaluations, remediation plans, signed agreements, hour logs. Supervisees trust that their progress is recorded accurately. Supervisors trust that their notes and evaluations stay confidential. Organizations need assurance that records across their entire team are handled consistently and securely. We apply the same security controls to all of it, regardless of role or account type.

Encryption

All data is encrypted in transit using TLS 1.2 or higher. Data stored in our database and file storage is encrypted at rest using AES-256. Sensitive credentials like OAuth tokens are encrypted at the application level before being written to the database.

Authentication

Guidara does not store passwords. Users log in through passwordless magic links, Google, or Microsoft.

Access Controls

The platform enforces role-based permissions. Supervisors, supervisees, and organization administrators each have distinct access scopes. Supervisees cannot see supervisor-only data like private prep notes, and users cannot access records outside their organization.

Infrastructure

Guidara runs on managed cloud infrastructure hosted in US-based data centers. Our providers maintain SOC 2 Type II and ISO 27001 certifications. We do not use shared hosting.

Databases are isolated in private networks with no direct public internet access. File storage uses server-side encryption with time-limited, signed URLs for controlled access. There are no public storage buckets. All infrastructure accounts require multi-factor authentication, and access is restricted to authorized personnel only.

Payments

Guidara never stores or processes payment card data. All billing is handled by Stripe, a PCI DSS Level 1 compliant payment processor, through secure API integrations.

Backups and Recovery

Our database providers run automated daily backups with point-in-time recovery. File storage is redundantly stored across multiple availability zones. In the event of a complete infrastructure failure, estimated recovery time is under four hours.

Document Integrity

Exported PDFs include SHA-256 cryptographic hashes and a verification certificate with a scannable QR code. Anyone with the document, whether a licensing board, employer, or auditor, can verify its authenticity and confirm it hasn't been altered. E-signatures are timestamped with signer identity verification, and all supervision records carry creation and modification timestamps for a built-in audit trail.

Monitoring

We monitor application health, errors, and uptime around the clock with automated alerting. Deployments are tracked and issues surfaced immediately. If something breaks, we know about it before you do.

Incident Response

If a security incident is detected, we isolate the issue, assess scope, and notify affected customers within 72 hours of a confirmed breach involving customer data. Every incident gets a post-mortem review and preventive follow-up.

What We Don't Store

• Social Security numbers
• Payment card numbers or bank account details
• Client health records or Protected Health Information (PHI)
• Passwords

Guidara is designed to document the supervision relationship, not to serve as a client health record. The platform is not HIPAA-compliant and should not be used to store Protected Health Information. If you reference client cases in supervision notes, you are responsible for de-identifying that information. For more detail, see the Clinical Data and HIPAA section of our Privacy Policy.

This page reflects Guidara's current security practices. For legal disclosures about data collection, sharing, and your rights, see our Privacy Policy.