SECURITY · 08
BilateralSync is designed to minimize the data collected during a therapy session. This page describes the controls that are enabled today.
BilateralSync does not require any client-side account. We do not collect client names, email addresses, phone numbers or other personal identifiers. A session is identified by a short unguessable code that expires when the session ends.
All traffic between the therapist, client and our servers is encrypted in transit using TLS. Real-time session state is exchanged over secure channels.
Sessions use randomly generated codes with sufficient entropy that they cannot be guessed. Codes expire and are rotated for each new session.
We use cookieless, anonymous analytics that do not track individuals across sites and do not require a cookie consent banner.
BilateralSync is hosted on established cloud infrastructure with industry-standard operational security. A current list of sub-processors is available on request.
If you believe you have found a security issue, please use our contact form at /contact and select the Security subject. We aim to acknowledge reports within two business days.
See also our privacy policy and terms of service.