Payment Security

PCI DSS (Payment Card Industry Data Security Standard) is a set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment.

By using Stripe, we qualify for the simplest level of PCI compliance (SAQ A) because:

• Card data is collected directly by Stripe, not by our servers

• We don't store, process, or transmit cardholder data

• Stripe handles all security requirements on our behalf

We only store non-sensitive payment information that Stripe provides after processing:

• Last 4 digits of your card

• Card brand (Visa, Mastercard, etc.)

• Card expiration month and year

This information falls outside of PCI compliance scope and is safe to store. We never have access to your full card number, CVV, or PIN.

Your therapy data is protected with industry-leading security measures:

• UK data residency - All therapy data is stored exclusively in UK-based AWS data centres

• Encryption at rest - All data is encrypted using AES-256 encryption

• Encryption in transit - All connections use TLS 1.2+ encryption

• Access controls - Only you can access your client data, with JWT-based authentication

• Regular security audits - Our infrastructure undergoes regular security assessments

SOC 2 (System and Organization Controls 2) is an auditing procedure that ensures service providers securely manage data to protect the interests and privacy of their clients.

TherapyVault.ai is SOC 2 ready, which means our infrastructure meets rigorous standards for:

• Security - Protection against unauthorized access

• Availability - System uptime and reliability

• Confidentiality - Protection of sensitive information

• Privacy - Proper collection, use, and disposal of personal information

We maintain comprehensive security documentation that is available upon request. This includes:

• Security architecture documentation

• Data protection and privacy policies

• Incident response procedures

• Compliance certifications and attestations

For enterprise customers or organizations requiring detailed security reviews, please contact us at security@therapyvault.ai