Security
How we protect student information
Last updated September 16, 2026
The short version
- Each therapist's caseload is locked to their own account by rules inside the database itself.
- All data is encrypted while it travels, and encrypted at rest by our database provider.
- Student data is stored in the United States.
- We never sell data, show ads, or use student information for anything but running MinutesMet for you.
- If you stop paying, you're never locked out of your records.
Your caseload is walled off
Every student, session, goal, evaluation and schedule entry is tied to the account that created it. The database enforces this with row-level security policies, which means the rule is checked by the database on every single request, not just by the app's screens. Another therapist's account cannot read or change your records, even if they tried to bypass the app.
Anonymous access is switched off. Having the web address alone gets nobody into any data.
Encryption
- In transit: the website, the app and the database only accept encrypted HTTPS connections.
- At rest: stored data is encrypted by our database provider.
- Passwords: we never see or store your password. It's handled by our authentication provider and stored only as a secure hash.
Where data lives, and who processes it
| Provider | What it does | Location |
|---|---|---|
| Supabase | Database and sign-in. Stores caseload data and account details. | United States (Ohio) |
| Vercel | Hosts the website and app, and runs the billing code. | United States |
| Stripe | Payments. Card numbers go straight to Stripe and never touch our systems. | United States |
We don't use analytics trackers, advertising networks or social media pixels on the website or in the app.
On your devices
So the app works in buildings with poor Wi-Fi, a copy of your caseload is kept on the device you're signed in on. Signing out deletes that copy, which matters on shared school computers. We recommend a passcode on any phone or tablet you use for work.
Payments can't unlock accounts
Subscription status can only be changed by a verified message from Stripe. The app itself cannot mark an account as paid, and every message from Stripe is checked for a valid cryptographic signature before it's trusted.
Access by us
Access to the production systems is limited to the founder. We look at account data only when you ask for help and give permission, or when the law requires it.
If something goes wrong
If we learn of a security incident affecting your information, we'll notify affected users without unreasonable delay, explain what happened, and tell you what we're doing about it.
For schools and districts
MinutesMet is designed for therapists who work with education records and are responsible for protecting them under FERPA and their district's policies. If your district needs a data privacy agreement or has a security questionnaire, email hello@minutesmet.com.
Report a security issue
If you believe you've found a vulnerability, please email hello@minutesmet.com with the details. Please don't access other people's data while testing. We'll respond as quickly as we can and credit you if you'd like.
See also our Privacy Policy and Terms of Service.