אבטחה

1. Infrastructure

Relvema runs entirely on Google Cloud and Firebase — HIPAA-eligible infrastructure used by healthcare organizations worldwide. All compute, storage, and databases are hosted in Google Cloud regions in the United States with automatic redundancy and a 99.9% uptime SLA. Databases are protected by point-in-time recovery and daily encrypted backups retained for seven weeks.

2. Encryption

Data at rest is encrypted with AES-256 via Google Cloud KMS. All data in transit is protected by TLS 1.2 or higher. Session audio files stored in Cloud Storage are additionally protected by signed, time-limited download URLs — raw audio is never exposed to the browser.

3. Session recordings

Audio recordings exist only long enough to be processed. By default, the recording is permanently deleted from our servers the moment your transcript and clinical note are ready — typically within minutes of the session ending. Your notes and transcripts remain; the audio itself is gone.

If a recording cannot be processed, or a therapist chooses to retain one, it is still deleted automatically after 30 days at the latest. This is enforced by a storage-level lifecycle policy that operates independently of our application code, as an additional safeguard.

4. Access controls

Firestore security rules enforce strict per-user data isolation. Therapists can only access data for patients explicitly linked to their account. Our servers hold no long-lived credentials at all: an organization-level policy blocks the creation of downloadable service account keys, and every server-side operation authenticates with short-lived tokens issued to the service identity attached to the running workload. There is no key file to leak, in source code, in environment variables or anywhere else.

5. Authentication

All user authentication is handled by Firebase Auth, which provides brute-force protection, account lockout, and session token management. Passwords are never stored in plain text. Social sign-in (Google, Apple) follows OAuth 2.0 with PKCE. Therapist accounts require a second factor, and that requirement is enforced on the server, not just in the interface.

6. Audit & monitoring

Google Cloud’s built-in audit logging captures all data access events, including the identity behind every read and write of records containing PHI. API endpoints are protected by per-client rate limiting, and anomalous access patterns trigger automated alerts reviewed by the Relvema security team.

7. AI data handling

Session audio and transcripts are processed exclusively by Google Vertex AI (Gemini model) within Relvema’s Google Cloud infrastructure. This processing is covered by Google Cloud’s data processing agreement; data is not used to train Google’s foundational models. Insights are generated per-request and stored only in the patient’s Firestore record. PHI never leaves the Google Cloud network boundary.

8. Found a vulnerability?

If you believe you’ve discovered a security issue in Relvema, please report it responsibly. We investigate all reports and respond within 48 hours. Email us at security@relvema.com.