# Data Security at Therify

Last updated October 1, 2024

Therify implements industry-standard security measures through Supabase's enterprise-grade infrastructure, complemented by our HIPAA compliance protocols.

**1. Authentication Security**  
**Passwordless Authentication Protocol**  
Implementation of Supabase Auth utilizing secure passwordless authentication:  
- Email-based verification system eliminating password-related vulnerabilities  
- One-time magic link authentication  
- Cryptographically secure token generation  
- Time-limited authentication links  
- Protection against email enumeration attacks  
- Rate limiting on email verification attempts  
- Automatic invalid token cleanup

**Session Management**  
- Secure session tokens using JWT (JSON Web Tokens)  
- Configurable session duration  
- Automatic session termination upon security events  
- Real-time session invalidation capabilities  
- Email-based session recovery protocols

**2. Data Storage and Encryption**  
**At-Rest Encryption**  
- All data at rest encrypted using AES-256 encryption  
- Database encryption through PostgreSQL's native encryption capabilities  
- Encryption key management through AWS KMS (Key Management Service)

**In-Transit Encryption**  
- TLS 1.2+ encryption for all data in transit  
- Forced HTTPS connections  
- Perfect Forward Secrecy (PFS) enabled  
- Regular SSL/TLS certificate rotation

**3. Infrastructure Security**  
**Database Protection**  
- Row-Level Security (RLS) policies enforced at the database level  
- Automated backup systems with encryption  
- Regular security patches and updates  
- Continuous monitoring and threat detection  
**Network Security**  
- Web Application Firewall (WAF) implementation  
- DDoS protection  
- IP whitelisting capabilities  
- Regular security scanning and penetration testing

**4. Compliance and Certification**  
**Standards Adherence**  
- Continuous compliance monitoring  
**Data Privacy**  
- PHI handling in accordance with HIPAA requirements  
- Data minimization principles  
- Strict access controls and audit logging  
- Secure data deletion protocols

**5. Access Control**  
**Administrative Controls**  
- Role-based access control (RBAC)  
- Principle of least privilege enforcement  
- Regular access review and certification  
- Comprehensive audit logging of all access events  
**Technical Controls**  
- IP-based access restrictions  
- Multi-factor authentication capability  
- Automated account lockout procedures

**6. Incident Response**  
**Security Monitoring**  
- 24/7 infrastructure monitoring  
- Real-time security alerts  
- Regular security assessments  
**Incident Management**  
- Documented incident response procedures  
- Dedicated security response team  
- Regular incident response testing  
- Client notification protocols

**7. Business Continuity**  
**Disaster Recovery**  
- Regular backup procedures  
- Geographically distributed redundancy  
- Documented recovery procedures  
**Service Reliability**  
- High availability infrastructure  
- Automated failover capabilities  
- Regular performance monitoring  
- Scheduled maintenance windows

**8. Updates and Maintenance**  
**Security Updates**  
- Regular security patches  
- Automated vulnerability scanning  
- Scheduled maintenance periods  
- Change management procedures  
**Documentation**  
- Regular policy reviews  
- Updated security procedures  
- Employee training programs

#### If you’re experiencing an emergency and need immediate help, call 911 or go to the nearest emergency room.

##### Suicide Prevention Lifeline  
[+ 1-800-273-8255](tel:+18002738255)  [Call or text: 988](tel:988)  
##### crisis text line  
Text HOME to 741741  
[Privacy policy](https://therify.co/utility/privacy)  [Terms of use](https://therify.co/utility/terms)  [Contact](https://therify.co/contact)

© 2024 Therify, Inc. All rights reserved.