BEHCA
Book a demo
TRUST

Security at BEHCA

Care teams trust BEHCA with some of the most sensitive information there is — behavior, health, and medication records for the people they support. Protecting that data isn't a feature we added. It's the constraint we design around.

Infrastructure

BEHCA runs on Amazon Web Services — infrastructure independently certified against SOC 1, SOC 2, ISO 27001, and FedRAMP. On top of that foundation:

Regional data residency. US data stays in US data centers; Australian data — including backups — stays in AWS Sydney.
Tenant isolation. Each organization's records are logically separated — never visible to another's.
Encryption everywhere. In transit (TLS) and at rest.
Least-privilege access. Production access only where the role requires it — and it's logged.
Monitoring & escalation. Continuous monitoring with defined escalation paths.
Resilience. Regular backups with tested restoration procedures.

Compliance

Our security program is managed continuously through Drata — controls monitored every day, not just at audit time.

AUDIT IN PROGRESS
SOC 2
Examination underway with an independent auditor. Prospective customers can review controls and readiness under NDA today.
PROGRAM ACTIVE
HIPAA
Aligned to the HIPAA Security Rule; we sign Business Associate Agreements with covered-entity customers.
COMING SOON
Trust Center
A self-serve trust center (SafeBase) for reviewing security documentation and audit reports directly.

How we handle your data

Your data is yours. You own the records; we process them only to provide the service.
We don't sell it — ever. No sale, no third-party advertising, no marketing use of client records.
No AI training on identifiable data without your consent.
You can leave with your data. A defined export window before deletion when a subscription ends.
Regulated data gets regulated treatment. BAAs for HIPAA-covered customers; contractual protections for schools and agencies.

People and process

Named accountability. Security has an owner on leadership — not a shared inbox.
Confidentiality by default. Everyone is bound by confidentiality obligations and completes security training.
Humans stay in the loop. Alerts, patterns and AI-assisted insights are decision support for qualified people — never a replacement.
Real incident response. A defined response plan with customer notification obligations — not a support queue.

Subprocessors

We use a small set of vetted service providers to run BEHCA. Each is bound by data-protection terms, and this list is kept current — material changes are announced in advance.

Amazon Web Services
PURPOSEHosting, storage & backups
REGIONUS (US customers) · Sydney (AU customers)
AWS SES
PURPOSETransactional email delivery
REGIONIn-region (Sydney for AU)
Stripe
PURPOSEBilling & payments (no client records)
REGIONGlobal
Chatwoot
PURPOSECustomer support conversations (no client records)
REGIONUS
Drata
PURPOSECompliance monitoring (no client records)
REGIONUS
Google Firebase
PURPOSEMobile Push Notifications
REGIONGlobal
Found a security issue? Questions about compliance?
Good-faith vulnerability reports, documentation requests, SOC 2 timeline, BAA setup: security@behca.com
Contact us

This page describes our security program as of the date published and is provided for information; it is not a warranty or contractual commitment. Contractual terms are set out in our Terms of Service, Privacy Policy, and, where applicable, a Business Associate Agreement.

Security at BEHCA | BEHCA