We built the protections into the architecture. Here's specifically how ABAVault™ protects PHI.
Every database query is scoped to your organization at the application layer. Cross-organization requests are rejected outright rather than merely hidden.
Every capability in the platform, from viewing a client address to exporting billing, is gated to explicit roles. RBTs and BTs see only their assigned caseloads.
MFA on staff accounts, with separate authentication surfaces for staff and caregivers. A family login can never reach staff functionality.
Caregivers see only the clients they are linked to, and only what a BCBA explicitly shares. Raw clinical data is never exposed to the portal.
On Android the app blocks screenshots and screen recordings of client data. Apple gives apps no reliable way to do the same, so on iPhone and iPad a screenshot is still possible.
Deletions are recoverable and auditable. Records leave the system through a controlled deletion-request workflow rather than a keystroke.
Administrative and clinical actions are recorded in activity logs: who did what, to which record, when.
AI drafts notes; it never signs them. Every AI call is logged with model and prompt version, output is marked as AI-generated for audit, and a clinician must review and sign. Drafting can also be switched off entirely, per role or for the whole organization.
AI drafting is off until an owner or administrator turns it on. Before it can be, the product records who confirmed, and when, that a business associate agreement covers the AI provider and that the provider does not train models on the data. Only the data needed to produce the draft leaves the platform. Our subprocessor list is available on request.
Flagged-content review and moderation tools on all messaging, including caregiver channels.
Data encrypted in transit (TLS) and at rest on AWS infrastructure.
We sign a business associate agreement with your practice before your first login, not at the end of an evaluation. The terms are on the BAA page. Our AI and infrastructure subprocessors are BAA-covered as well.
A SOC 2 examination is on our roadmap; ask us for the current status and our security documentation during evaluation.
Questions from your security or compliance reviewer? We complete security questionnaires and answer architecture questions in writing. Get in touch.
Support expectations belong on the website where you can read them before you buy. These are ours, and we'd rather under-promise here than surprise you later.
Billing-blocking and care-blocking issues (claims that won't submit, a payroll export that won't build, data collection down) jump the queue and page us immediately. We are a small team and ABAVault is in beta, so rather than publish turnaround numbers we would have to revise later, beta practices get a shared channel with the people who write the code. We will publish response targets once we can commit to keeping them every week.
In-app support tickets are the front door: categorized forms, priority flags, attachments, and a threaded conversation on every ticket. Nothing ends up buried in one person's inbox. The searchable help center answers the common questions instantly, and every practice gets a direct phone line at onboarding for the moments a ticket is too slow.
You'll usually hear from the person who wrote the code. We're a small team by design, so nobody is going to read you a tier-one script or route you through a phone menu.
Support is included for every practice at every size: same product, same humans, no paid support tiers. Response targets are service goals rather than contractual SLAs; the Terms of Service govern the legal relationship.