Security

1. Infrastructure

Relvema runs entirely on Google Cloud and Firebase — HIPAA-eligible infrastructure used by healthcare organizations worldwide. All compute, storage, and databases are hosted in Google’s us-central1 region with automatic redundancy and a 99.9% uptime SLA. Databases are protected by point-in-time recovery and daily encrypted backups retained for seven weeks.

2. Encryption

Data at rest is encrypted with AES-256 via Google Cloud KMS. All data in transit is protected by TLS 1.2 or higher. Session audio files stored in Cloud Storage are additionally protected by signed, time-limited download URLs — raw audio is never exposed to the browser.

3. Session recordings

Audio recordings exist only long enough to be processed. By default, the recording is permanently deleted from our servers the moment your transcript and clinical note are ready — typically within minutes of the session ending. Your notes and transcripts remain; the audio itself is gone.

If a recording cannot be processed, or a therapist chooses to retain one, it is still deleted automatically after 30 days at the latest. This is enforced by a storage-level lifecycle policy that operates independently of our application code, as an additional safeguard.

4. Access controls

Firestore security rules enforce strict per-user data isolation. Therapists can only access data for patients explicitly linked to their account. Admin SDK credentials are stored in Google Secret Manager and rotated regularly — never in source code or environment variables checked into version control.

5. Authentication

All user authentication is handled by Firebase Auth, which provides brute-force protection, account lockout, and session token management. Passwords are never stored in plain text. Social sign-in (Google, Apple) follows OAuth 2.0 with PKCE.

6. Audit & monitoring

Google Cloud’s built-in audit logging captures all data access events. Firebase App Check protects API endpoints from abuse. Anomalous access patterns trigger automated alerts reviewed by the Relvema security team.

7. AI data handling

Session audio and transcripts are processed exclusively by Google Vertex AI (Gemini model) within Relvema’s Google Cloud infrastructure. This processing is covered by Google Cloud’s data processing agreement; data is not used to train Google’s foundational models. Insights are generated per-request and stored only in the patient’s Firestore record. PHI never leaves the Google Cloud network boundary.

8. Found a vulnerability?

If you believe you’ve discovered a security issue in Relvema, please report it responsibly. We investigate all reports and respond within 48 hours. Email us at security@relvema.com.