Security at Linea

Linea exists to hold the most sensitive data a therapist works with, so security is a design constraint, not a feature list. This page explains in plain language how your data is protected. The Privacy Policy describes what we process and why; this page describes how.

Two encryption layers

Linea deliberately does not call itself "zero knowledge" — different data gets different protection, and we want you to know exactly which is which.

The clinical vault: end-to-end encrypted

Session notes, note titles and risk levels, therapy-goal descriptions, client core profiles, session plans and case formulations are encrypted in your browser before anything is sent to us. Encryption uses AES-256-GCM under a master key that is wrapped by a key derived from your passphrase with Argon2id. The server stores only ciphertext and wrapped key material — it never receives your passphrase, recovery words or the plaintext master key. Every encrypted record is also cryptographically bound to your account and to the specific record it belongs to, so ciphertext cannot be silently swapped between records or practices.

Linea cannot read this content. Not our operator, not our database, not our backups. If you lose both your passphrase and your 24-word recovery sheet, the vault content is permanently gone — we cannot restore it, by design.

Operational data: server-side field encryption

To run your schedule, the server has to work with booking requests, appointment times and your clients' contact details. Client names, emails, phone numbers and intake answers are encrypted at rest with server-side keys and bound to your account; the API decrypts them only where the product needs them. Structural data such as appointment timestamps and statuses remains readable by the server — that is what makes a calendar work.

Account protection

Account passwords are hashed with Argon2id. Repeated failed sign-ins are throttled and temporarily locked. Sensitive actions — exports, erasures, note edits and deletions — are recorded in a tamper-resistant, append-only audit log. Exporting your full vault requires re-entering your passphrase even in an unlocked session, and the vault locks itself after inactivity.

Isolation between practices

Every private record carries the owning therapist's identity at the database layer, and every query filters by the authenticated owner. Automated tests assert that one practice can never read, change or infer another practice's data.

Application security

The product ships with a strict Content-Security-Policy, CSRF protection on every state-changing request, rate limiting on authentication and public endpoints, and structured logs that redact personal data. Clinical content is never written to logs.

Infrastructure

Linea runs on EU-region infrastructure: application servers in Frankfurt, a managed PostgreSQL database in an EU region, and object storage under EU jurisdiction, with TLS on every connection. The full provider list — including the one documented exception for transactional email — is published in the Privacy Policy.

Backups and deletion

The database keeps a bounded point-in-time recovery window. Deletion is designed to survive backups: deleting your account crypto-shreds the wrapped vault-key material within 24 hours and a tombstone mechanism re-shreds it if an older backup is ever restored. Deleting a client starts a 30-day undo window, after which the client's identity and every linked clinical artifact are irreversibly erased.

For your compliance

You are the controller of your clients' data; Linea processes it for you under the Data Processing Agreement published alongside this page. Our data-protection impact assessment and technical-measures documentation are available on request at [email protected].

Reporting a security issue

If you believe you have found a vulnerability, email [email protected] with enough detail to reproduce it. Reports are read with priority; please give us reasonable time to fix an issue before disclosing it publicly.