Draft for attorney review. Not yet in effect.

Security at IntakeAlly

Last updated: [Effective date]

IntakeAlly holds sensitive records about the people your organization serves. This page explains, in plain terms, how we protect them. It is a summary for organizations evaluating IntakeAlly; our contractual commitments are in the Customer Agreement and Business Associate Agreement.

Where we are today. We are setting up our hosting on Amazon Web Services (AWS). Safeguards that depend on that infrastructure, such as encryption at rest and backups, take effect at launch, and this page says "at launch" where that applies.

Your organization's data stays separate

Tenant isolation. Every record in IntakeAlly belongs to exactly one organization. Access checks run on every request to make sure people see only their own organization's data.
Role-based access. Each person gets a role that limits what they can see. Coordinators see only the cases assigned to them. Outside accountants see case numbers, not client names.

Passwords must be at least 12 characters. We store them only as bcrypt hashes, never in readable form.
Two-step sign-in with an authenticator app is available to every user, and organizations can require it for their whole team.
Account lockout kicks in after repeated failed sign-in attempts.
Session limits. Sessions last up to 8 hours, and users are signed out automatically after 30 minutes without activity.

Visibility for administrators

Activity log. IntakeAlly records important actions, including who viewed each case and when. Organization administrators can review this log at any time.

Encryption

In transit. All connections to IntakeAlly use HTTPS.
At rest (at launch). Stored data and files are encrypted using keys managed in AWS Key Management Service (KMS).
Bank connection tokens are encrypted separately with AES-256-GCM.

We collect less, so there is less to lose

We never collect Social Security numbers.
We never collect bank account or routing numbers. Bank connections go through Plaid's own window, and payroll details are entered directly on Gusto's pages.

AI features

Amazon Bedrock only. When IntakeAlly reads documents or drafts text, it uses Anthropic's Claude models through Amazon Bedrock, inside AWS, under our Business Associate Agreement with AWS. Client records are not sent to any other AI service.
No training. Your data is not used to train AI models. Amazon Bedrock does not use inputs or outputs to train models.
Human review. AI output is always a draft that a qualified professional at your organization must review and approve.

Hosting and backups

U.S. only. Client records are stored and processed only in the United States.
Backups (at launch). Data is backed up so it can be restored after an outage or error. Backups are encrypted and roll off on a fixed schedule.
Source code. Our source code is hosted on GitHub, which never receives customer data.

Agreements

With you. We sign a Business Associate Agreement with every customer organization, accepted in the app by an administrator before real client records are uploaded.
With our subprocessors. AWS, the only subprocessor that handles client records, is covered by a Business Associate Agreement. See our Subprocessors page.

People

Training and confidentiality. Our personnel with access to customer data receive privacy and security training and sign confidentiality agreements.
Your team, too. Every team member and independent coordinator in your organization must accept our Confidentiality and Acceptable Use Agreement before seeing client records.

Incident response

We maintain an incident response process to detect, contain, and investigate security incidents. If an incident affects your organization's client records, we will notify you as the Business Associate Agreement requires so you can meet your own obligations, and we will work with you through the response.

What we do not claim

IntakeAlly is designed to support HIPAA compliance, but there is no official "HIPAA certification," and we do not hold SOC 2 or similar third-party certifications at this time. Compliance also depends on how each organization uses the Service.

Report a security concern

If you believe you have found a security vulnerability or suspect an incident, email support@example.com. Please do not include client records in your message.