Trust & Security Center

How we protect your data and privacy

Our Security Commitment

At Sippi, security and privacy are fundamental to everything we do. We've built our platform with enterprise-grade security measures and HIPAA-ready architecture to ensure your emotional wellness data remains safe, private, and under your control.

Encryption & Data Protection

• Encryption at rest: All stored data is encrypted using industry-standard AES-256 encryption
• Encryption in transit: All data transfers use TLS 1.3 protocol
• Secure storage: Data hosted on enterprise-grade infrastructure with redundant backups
• Zero-knowledge architecture: Your conversations are encrypted and private

Access Control

• Role-based access control (RBAC): Users can only access data appropriate to their role
• Multi-factor authentication: Optional MFA for enhanced account security
• Session management: Automatic logout and secure session handling
• Consent-based sharing: Data shared with clinicians only with explicit user consent

Privacy Controls

• Data ownership: You own your data and control who can access it
• Granular sharing: Choose exactly what data to share with clinicians
• Audit logs: Track who accessed your data and when
• Right to deletion: Request complete data deletion at any time
• No third-party sales: We never sell your personal information

HIPAA-Aligned Safeguards

Sippi is designed with HIPAA-aligned safeguards to support healthcare organizations deploying in regulated environments:

• Technical safeguards designed to protect health information
• Administrative controls and role-based access management
• Audit logging capability for access tracking
• Business Associate Agreements (BAA) available for enterprise customers
• Supports compliance workflows such as access controls and secure data handling

Important: HIPAA compliance is not a product certification. If deployed in a HIPAA-regulated environment, compliance depends on appropriate organizational policies, agreements, and implementation. Sippi does not claim to be "HIPAA certified" or guarantee compliance—such determination requires coordination with your organization's compliance team.

Infrastructure & Monitoring

• Redundant systems: High availability with 99.9% uptime SLA
• Security monitoring: 24/7 threat detection and response
• Regular audits: Quarterly security assessments and penetration testing
• Incident response: Documented procedures for security incidents
• Data residency: Control where your data is stored (enterprise)

Compliance & Certifications

• SOC 2 Type II: In progress (target: Q3 2026)
• GDPR compliant: EU data protection standards
• CCPA compliant: California privacy rights
• Regular updates: Security measures continuously improved

Questions About Security?

Our security team is here to answer your questions about data protection, compliance, or enterprise deployment.

Contact: security@sippi.app

Security Disclosure: If you discover a security vulnerability, please report it responsibly to security@sippi.app. We appreciate responsible disclosure and will work with you to address any verified issues.