Security
How we protect student information
Last updated October 27, 2026
The short version
- Each therapist's caseload is locked to their own account by rules inside the database itself.
- All data is encrypted while it travels, and encrypted at rest by our database provider.
- You can turn on two-step sign-in, so a password alone doesn't open your caseload.
- A signed session note can't be changed, and the database logs when notes are signed and deleted.
- Student data is stored in the United States.
- We never sell data, show ads, or use student information for anything but running MinutesMet for you.
- If you stop paying, you're never locked out of your records.
Your caseload is walled off
Every student, session, goal, progress record and schedule entry is tied to the account that created it. The database enforces this with row-level security policies, which means the rule is checked by the database on every single request, not just by the app's screens. Another therapist's account cannot read or change your records, even if they tried to bypass the app.
Anonymous access is switched off. Having the web address alone gets nobody into any data.
Two-step sign-in
You can turn on two-step sign-in in the app, under More, in the Account section. After that, signing in takes your password and a 6-digit code from an authenticator app on your phone. Someone who learns your password still can't open your caseload without the code from your authenticator app.
The database checks this too, not just the app's screens. Once two-step sign-in is on, a session that has had only the password gets no data back, even if someone tries to reach the database directly. The same goes for opening billing.
It's optional and off until you turn it on. Turning it off again needs a current code from the app.
Signed notes
Once you sign a session note, the database keeps it as signed. Its text can't be changed and it can't be un-signed. The signing time comes from the server's clock, not your device. Corrections are added as dated addenda, alongside the original.
The database also keeps a log of when each note was signed, when an addendum was added, and when a note was deleted. Each entry holds the time and a fingerprint of the text, not the text itself. The database writes these entries itself; your account can read its own log but can't change or delete it. "Delete all data" keeps the log, because deletions are what it records. Deleting your whole account deletes its log too.
Encryption
- In transit: the website, the app and the database only accept encrypted HTTPS connections.
- At rest: stored data is encrypted by our database provider.
- Passwords: we never see or store your password. It's handled by our authentication provider and stored only as a secure hash.
Where data lives, and who processes it
| Provider | What it does | Location |
|---|---|---|
| Supabase | Database and sign-in. Stores caseload data and account details. | United States (Ohio) |
| Vercel | Hosts the website and app, and runs the billing code. | United States |
| Stripe | Payments. Card numbers go straight to Stripe and never touch our systems. | United States |
| Zoho | Sends account emails such as sign-up confirmations and password resets. Receives no student data. | United States |
| Resend | Sends subscription emails: the confirmation after subscribing and the reminder before a yearly renewal. Receives the subscriber's email address, name and plan. Receives no student data. | United States |
We don't use analytics trackers, advertising networks or social media pixels on the website or in the app.
On your devices
So the app works in buildings with poor Wi-Fi, a copy of your caseload is kept on the device you're signed in on. Signing out deletes that copy, which matters on shared school computers. If your session ends on its own before your latest changes have uploaded, only those unsent changes stay on the device, so your work isn't lost; they upload when you sign back in. We recommend a passcode on any phone or tablet you use for work.
Payments can't unlock accounts
Subscription status can only be changed by a verified message from Stripe. The app itself cannot mark an account as paid, and every message from Stripe is checked for a valid cryptographic signature before it's trusted.
Access by us
Access to the production systems is limited to the founder. We look at account data only when you ask for help and give permission, or when the law requires it.
If something goes wrong
If we confirm a security incident affecting your information, we'll notify affected users within 72 hours of confirming it, explain what happened, and tell you what we're doing about it, with fuller detail as we learn more. That is the standard the National Data Privacy Agreement sets for school vendors, and we hold ourselves to it whether or not your district has asked us to sign one.
For schools and districts
MinutesMet is designed for therapists who work with education records and are responsible for protecting them under FERPA and their district's policies. If your district needs a data privacy agreement or has a security questionnaire, email hello@minutesmet.com.
Report a security issue
If you believe you've found a vulnerability, please email hello@minutesmet.com with the details. Please don't access other people's data while testing. We'll respond as quickly as we can and credit you if you'd like.
See also our Privacy Policy and Terms of Service.