Security in plain language

1Where stored: All data is processed and stored in European Union data centers.
2How encrypted: Content is protected with application-layer AES-256 encryption. PR-TOP is not end-to-end encrypted and not zero-knowledge — the platform operator holds the decryption keys.
3Who can access: Only the application layer (using a master key held by the platform operator) can decrypt clinical content. Database-level access alone is insufficient. PR-TOP support does not access your clinical data under normal operation.
4Audit trail: Every access to sensitive data is recorded in a tamper-proof audit log. Therapists can view their own access log in the dashboard.
5GDPR: All data is stored and processed within the EU. You can request a full export or deletion of your data at any time.

Encryption at Rest (AES-256)

All sensitive client data stored in our database is encrypted using AES-256, the same standard used by banks and government agencies. Each record is encrypted with a unique initialization vector, ensuring that even identical data produces different ciphertext.

Database backups inherit the same encryption, so your data remains protected even in cold storage.

Encryption in Transit (TLS 1.3)

Every connection between your browser and PR-TOP servers is secured with TLS 1.3, the latest and most secure transport layer protocol. This prevents eavesdropping, tampering, and man-in-the-middle attacks.

We enforce HSTS (HTTP Strict Transport Security) headers with a two-year duration to ensure your browser never accidentally downgrades to an unencrypted connection.

Application-Layer Encryption (Class A Data)

Beyond database-level encryption, PR-TOP applies a second layer of application-level encryption to all Class A sensitive data before it reaches the database. This means that even a database administrator cannot read the data without the application encryption keys. Class A data includes:

Client diary entries (text, voice transcripts, video transcripts)
Therapist session notes and summaries
Conversation messages between therapist and client
Therapist-entered anamnesis, contraindications, and clinical context fields
SOS alert content and exercise responses
Draft AI notes and session summaries awaiting therapist review

Key Management

Encryption keys are derived from a master key that is stored separately from the database. The master key is never committed to source code and is injected at runtime through secure environment variables.

Key rotation procedures are supported to periodically refresh encryption without disrupting service availability.

Access Model & Transparency

What is encrypted: all Class A data (diary entries, session notes, transcripts, AI summaries). Who can decrypt: only the application layer using the master key stored in a protected environment variable — database-level access alone is not sufficient. What support sees: under normal operation, no PR-TOP team member accesses your clinical content; technical support works with anonymized metadata and logs only.

The master key is held by the service operator and stored in a protected environment, separate from the database. In the event of a server breach, an attacker would encounter only encrypted ciphertext without the key.

Encryption & Data Protection