We designed Handshapes from the start for healthcare, education and legal interpreting, where the data is sensitive and you can expect to be audited.
Hosted on SOC 2-certified cloud infrastructure with managed compute and managed databases. Physical security, network isolation, and 24/7 monitoring are handled at the platform level.
All stored data is encrypted with AES-256. Database volumes, backups and object storage use provider-managed encryption keys.
All data in transit is encrypted with TLS 1.2 or higher. That covers API calls, browser sessions and traffic between our internal services.
Continuous encrypted backups with point-in-time recovery. If something goes wrong, we can restore to any moment in the retention window.
Managed database high availability with automatic failover.
Separate roles for agency admins, schedulers, interpreters, customers and Deaf consumers. Each role sees only what it should.
Postgres itself limits every database query to the user's role and organization. The restriction is enforced by the database engine, not by filters in our application code.
Separate database users for migrations and application queries. The application user cannot alter schema, and migration credentials are never available at runtime.
Secure sessions with configurable expiration, and multi-factor authentication that your organization can require.
Each time data is viewed or changed, it's recorded in an append-only audit log. Log entries can't be edited or deleted.
Each audit entry records who did what, to which record, and exactly when, so you can trace an action back to the database row it touched.
Audit trails meet HIPAA requirements for PHI access logging. Every view, export, or modification of protected health information is captured and retained.
Infrastructure and application monitoring with automated alerting. We know about issues before users do.
Encryption, audit logs, access controls, and breach notification procedures designed for HIPAA compliance. Business Associate Agreement available on request.
Cloud-hosted on SOC 2-certified providers with centralized logging, monitoring, and access controls aligned to the Trust Services Criteria.
Institutional isolation ensures student data stays within its organization. Strict access controls and educational-context data handling for K-12 and university interpreting.
DPA available for organizations that need contractual data protection commitments. We tell you how data is processed and where it's stored.
Handshapes does not process your data through AI models. AI features work through MCP (Model Context Protocol) connections that your team controls, using your own AI provider.
MCP connections respect the same RBAC and RLS boundaries as every other part of the platform. AI assistants can only access what the connected user is authorized to see.
MCP connections are off by default. Your organization decides whether and when to turn them on, and what to automate.
Organization data is logically isolated in a multi-tenant architecture with strict boundaries. Row-level security ensures one organization can never access another's data.
Your data is yours. You can export all of it, so you're never locked in.
We maintain a public list of sub-processors at /subprocessors. You can see who handles your data and why.
We can talk through our security practices, send documentation to your compliance team, or walk you through the architecture.
[email protected]