Security
Your supervision records, protected and private
Your staff, trainees and clients are real people, so we protect their records at every layer, down to each person's role.
- Hosted on AWS
- AES-256 encryption
- Single sign-on
Encrypted in transit and at rest
Stored in your region: Canada
Your organization only
Platform capabilities
Built for agencies of every size.
From one clinic to many, the protections an IT review looks for.
-
Single sign-on
Staff sign in through Microsoft Entra ID, Okta or any SAML 2.0 provider, on the Agency plan.
-
Multi-factor sign-in
With single sign-on, your provider's multi-factor rules apply to every sign-in.
-
Access by role
Admin, Supervisor, Supervisee and Viewer, or permissions you set one by one. The database enforces them.
-
Encrypted at rest
AES-256 for the database and every file you upload, session videos included.
-
Encrypted in transit
TLS 1.2 or higher on every connection, from your browser to the database.
-
Passwords we never see
Sign-in runs on Amazon Cognito, so your password never reaches our servers.
-
Strong passwords
At least 12 characters, with upper and lower case, a number and a symbol. Reset by email only.
-
AI assistants, no API keys
Claude, ChatGPT and other AI assistants connect with OAuth and act as the signed-in person.
-
Deleted when you choose
Delete sessions, notes and files yourself, any time, or ask us to delete all of your organization's data.
Infrastructure
An architecture that keeps records safe by design.
The walls between organizations are built into the database itself, not left to our code.
-
Runs only on AWS
Serverless compute and a managed PostgreSQL database on Amazon Web Services, with no data center of our own.
- AWS Lambda
- Aurora PostgreSQL
- Amazon Cognito
-
Each region on its own
Canada and the United States are separate deployments, each with its own sign-in and database. Your records and files are stored in your region.
- Canada app.ca.behaviewhq.com
- United States app.us.behaviewhq.com
-
Walls in the database
PostgreSQL row-level security limits every request to your organization. A missed filter in our code still cannot return another organization's records.
-
Tested on every change
On every change, automated tests try to reach across organizations, and every attempt must be refused. A new table without row-level security fails the build.
Refused across organizations
- Read
- Add
- Change
- Delete
How we run it
Discipline you can check.
Anyone can confirm the first three from a browser.
-
HTTPS only
The app tells browsers to use HTTPS and nothing else, for two years.
-
Old encryption switched off
Connections over TLS 1.0 and 1.1 are refused.
-
No framing
No other website can show the app inside a frame, so a hidden page cannot trick you into a click.
-
Multi-factor for our staff
Our staff use multi-factor sign-in for every production system.
Your data
What we keep, and never ask for.
Behaview asks only for what supervision needs.
What Behaview keeps
- Names, emails, roles and teams
- Skills, data and notes from each session
- Training guides, comments and the files you upload
Each person sees only what their role allows.
What Behaview never asks for
- Dates of birth
- Government ID numbers
- Diagnoses or medical records
- Bank or salary details
- Biometrics
Notes and custom fields are free text, so your team decides what goes in them.
Never sold. We do not sell or rent personal information.
AI
AI that works inside your permissions.
Behaview never uses your records to train an AI model.
-
Never used for training
Behaview's own AI, such as Coach Me, runs Anthropic's Claude models on Amazon Bedrock, with permission only to run them. It cannot train a model on your records.
-
Sees only what you can see
AI reads and writes through the same database walls as everything else, so it receives only what your organization could already read.
-
Your assistant acts as you
Claude, ChatGPT and other AI assistants connect with OAuth and use your permissions. Turn off someone's role and their access ends at once.
Behaview's AI runs in the United States by default, for the strongest models. Processing in Canada is available on request.
Get in touch
Questions, reports and reviews.
-
Report a security issue
Found a vulnerability? Tell us what you found, and we will follow up.
security@behaviewhq.com -
Privacy requests
Ask what we hold about you, or ask us to correct or delete it.
privacy@behaviewhq.com -
Security reviews
Send us your agency's questionnaire, or go through it with us on a call.
Talk to Sales
Bring your security questions to a demo.
We will walk through your region, your roles and who sees what.