Enterprise Security Built Into Every Layer
BloomSenz protects child therapy records, assessment data, family information, sessions, payments and centre operations through enterprise-grade security, monitoring and governance.
Security Built For Modern Therapy Centres
Seven layers of defence — every layer is engineered with explicit controls, monitored in real time and audited end-to-end.
Our Security Principles
Six pillars our security program is built on — every release is reviewed against them.
Identity & Access Management
Centralised identity with OAuth 2.0, OpenID Connect, JWT, SSO, MFA and granular RBAC scopes.
Data Protection
Encryption at rest + in transit, key rotation, data masking and secure backups for every therapy record.
Infrastructure Security
Network isolation, WAF, DDoS protection, intrusion detection and hardened container + cloud images.
Monitoring & Threat Detection
24×7 application, API and infrastructure monitoring with real-time alerts and runbooks.
Compliance & Governance
Audit logging, secure SDLC, privacy controls and a roadmap toward SOC 2, ISO 27001, HIPAA-aligned and GDPR readiness.
Business Continuity
Automated backups, point-in-time recovery, replication, failover and tested recovery procedures.
Secure Identity Management
Eight identity controls converging on a 4-step access flow — User → Authentication → Authorization → Resources.
User → Authentication → Authorization → Resources
Secure Tenant Isolation
Hard isolation across organisations, centres, roles, data and permissions — cross-tenant leakage is structurally prevented.
Three tenants · zero shared surfaces
Every datastore, cache, search index and AI knowledge base is scoped per tenant. Cross-tenant queries fail closed.
Protecting Sensitive Therapy Data
Six data categories covered by five always-on security controls.
What we protect
How we protect
- ✓Encryption At Rest
- ✓Encryption In Transit
- ✓Key Rotation
- ✓Secure Backups
- ✓Data Masking
Encryption Everywhere
Six encryption surfaces covering transport, storage, backups and secrets.
Complete Audit Visibility
Eight tracked action types and a queryable, exportable audit log per tenant.
Every meaningful action
Enterprise Infrastructure Security
Ten controls across network, application and runtime — defence-in-depth from the edge to the container.
API Security Controls
Eight controls plus a 5-hop request flow — every call is authenticated, scoped, rate-limited and observed.
Client → TLS → Gateway → Auth + Scope → Service
Responsible AI Architecture
Seven controls so RAG, agents and therapy copilots remain useful — without leaking data across tenants.
Privacy By Design
Eight first-class privacy capabilities — families and centres always own and control their data.
Compliance & Governance
Honest disclosure — what is in place today, and what's on the published roadmap. No certifications claimed before achieved.
- ✓Security Best Practices
- ✓Privacy Controls
- ✓Audit Logging
- ✓Secure Development Lifecycle
- ➜SOC 2
- ➜ISO 27001
- ➜HIPAA-aligned Controls for Therapy Records
- ➜GDPR Readiness
- ➜Data Residency Controls
* We don't claim certifications we haven't achieved. Status is updated as audits complete.
24×7 Monitoring & Detection
Eight monitoring surfaces feed real-time alerts, runbooks and dashboards.
Business Continuity
Seven always-on capabilities for backups, replication, failover and tested recovery.
Security From Design To Deployment
Eight stages — every release moves through the same secure pipeline.
Shared Responsibility Model
What BloomSenz owns vs what the therapy centre owns — clear lines, no surprises.
- ✓Platform Security
- ✓Infrastructure Security
- ✓Monitoring
- ✓Backups
- ✓Tenant Isolation
- ✓User Management
- ✓Password Policies
- ✓Permission Management
- ✓Device Security
- ✓Security Awareness
Security Questions, Answered
Eight of the most common security questions teams ask before standardising on BloomSenz.
How is data encrypted?
All data is encrypted at rest with AES-256 and in transit with TLS 1.3. Keys are rotated regularly and managed via a hardened secrets manager.
Where is data stored?
Customer data is stored in regional cloud regions chosen with each therapy centre. Data residency options are part of every enterprise rollout.
How are backups handled?
Automated, encrypted backups run on a continuous schedule with point-in-time recovery and tested restore runbooks.
Can I export my data?
Yes. Customer-controlled export is available across child records, therapy history, sessions and finance — via UI and API.
How is tenant isolation implemented?
Hard isolation at organisation, centre and role scopes — enforced in business services, datastores and audit logs. Cross-tenant leakage is structurally prevented.
How secure are AI features?
RAG, agents and prompts run inside per-tenant scopes. Therapy knowledge never leaks across tenants and every AI action is logged for auditability.
Can I use SSO?
Yes — enterprise SSO via OpenID Connect / SAML and MFA enforcement are available for all paid customers.
What audit logs are available?
Login, record access + changes, therapy plan updates, session changes, payment actions and role changes — exportable and queryable per tenant.
Security Resources
Seven documents your security and procurement teams can request — request via the security team.
Security Overview
↓ Request accessArchitecture Guide
↓ Request accessPrivacy Policy
↓ Request accessTerms of Service
↓ Request accessData Processing Agreement
↓ Request accessSecurity FAQ
↓ Request accessIncident Response Policy
↓ Request accessBuilt For Reliability
Eight always-on numbers that customer security teams can quote back to leadership.
Security you can trust. Platform you can scale on.
Protect your therapy centre operations, family data and care delivery with enterprise-grade security built into BloomSenz.