v2026-05-01

Security at HoldSpace

Last updated: March 2026

Your clients trust you with their most personal information. We take that responsibility seriously.

Encryption

In transit: all data between your device and HoldSpace — and between HoldSpace and our AI providers — is encrypted using TLS 1.2+. This includes web traffic, API calls, voice dictation streams, and all AI processing requests.

At rest: all data stored on our servers — databases, files, and caches — is encrypted using AES-256 (LUKS2). Encryption keys are managed by us, not our hosting provider.

Backups: all database backups are additionally encrypted using age (X25519 + ChaCha20-Poly1305) before storage. Decryption keys are stored offline, separate from production servers.

AI Security

When you use voice dictation, your speech is streamed directly to our transcription provider (Deepgram) and converted to text in real-time. Audio is never stored on our servers. Session notes are then processed by Google Gemini for structuring, status summaries, and deep analysis. Here's how we protect that data:

  • All AI requests travel over encrypted connections (TLS).
  • Deepgram model improvement opt-out is enabled — your dictation audio is not used for training AI models. Audio is processed on EU-based servers.
  • Note structuring and analysis use Google Gemini. Google is contractually prohibited from retaining or training on your data.
  • Note structuring and deep analysis run only when you explicitly request them. Session status summaries may update automatically when new notes are added.

Access Controls

  • Authentication required for all access.
  • Passwords hashed using industry-standard algorithms (bcrypt). We never store plaintext passwords.
  • Each practitioner can only access their own data — no cross-account access.
  • Client data visible only to the practitioner who created the record.
  • Server access restricted to SSH key-based authentication with CrowdSec protection against brute-force attacks.
  • Rate limiting applied to authentication endpoints and API routes.

Data Isolation

HoldSpace uses multi-tenant architecture with strict logical data separation. One practitioner cannot access another's data under any circumstances. AI processing sends only the requesting practitioner's data — never data from other accounts.

Data Deletion

When you delete a client record, all data associated with that client is removed:

  • Name, email, and bio
  • All session records
  • All note versions (transcription, structured, edited)
  • All AI-generated content (status summaries, deep analyses)
  • All intake form responses and booking history

Deleted data is fully removed from our servers within 30 days.

When you delete your account, all associated data — including every client, session, note, and form — follows the same process.

Audit Logging

We maintain an immutable audit trail of significant actions: account creation, logins, data access, modifications, deletions, AI processing events, and administrative actions. Audit records cannot be modified or deleted.

Infrastructure

  • Hosted on Hetzner dedicated servers in Finland (Helsinki).
  • Hetzner holds ISO 27001 certification and operates in DIN EN 50600 certified data centers.
  • All persistent data encrypted at rest (AES-256, LUKS2) on dedicated storage volumes.
  • Isolated Docker containers with restricted network access, dropped Linux capabilities, and privilege escalation prevention.
  • Automated encrypted backups with rotation.
  • File storage in isolated object storage (MinIO) with access controls.

Compliance

Framework Status
GDPR (EU/EEA) Privacy Policy published. Sub-processor list published. Data subject rights supported. DPIA conducted.
UK GDPR Covered under GDPR measures.
HIPAA (US) Not yet compliant. We do not offer BAA at this time. See our Terms of Service for details.
CCPA/CPRA (California) Privacy rights supported. We do not sell personal information.

Incident Response

In the event of a security incident:

  1. Immediate investigation and containment.
  2. Affected practitioners notified within 72 hours as required by GDPR.
  3. Details provided: nature of incident, data affected, and remediation steps.
  4. Cooperation with supervisory authorities as required by law.

Responsible Disclosure

Found a vulnerability? Report it to: [email protected]

We will not take legal action against researchers who report vulnerabilities responsibly and in good faith.

Your Role

Security is a shared responsibility. We recommend:

  • Use a strong, unique password for your HoldSpace account.
  • Do not share your login credentials with others.
  • Inform your clients that you use a cloud-based practice management tool and obtain their consent where required.
  • Review AI-generated content before relying on it — AI may produce errors.
  • Log out when using shared devices.

Questions

For security-related questions, contact us at [email protected].

For general privacy inquiries, see our Privacy Policy or contact [email protected].