Enterprise-Grade Security for Your Data
CasePlay implements comprehensive security measures to protect user data, practice sessions, and all therapeutic training content. Your security and privacy are our highest priorities—whether you're a student, educator, or practicing clinician.
Multi-Layered Security Architecture
We employ defense-in-depth strategies to protect your data at every level
Data Encryption
All data encrypted in transit using TLS 1.3 and at rest using AES-256 encryption standards
Secure Infrastructure
Built on SOC 2 Type II certified cloud infrastructure; uptime is supported by high-availability architecture
Access Controls
Role-based permissions, multi-factor authentication, and principle of least privilege
Continuous Security Focus
Platform integrity is maintained via secure development and integrated protection; native tools monitor for vulnerabilities to ensure a hardened environment
Incident Response
24/7 monitoring, automated threat detection, and documented incident response procedures
Compliance
We design our systems with privacy-first principles and look to frameworks like NIST as a guide for our internal security roadmap
Comprehensive Security Measures
Encryption & Data Protection
Encryption in Transit:All data transmitted between your browser and CasePlay servers is encrypted using Transport Layer Security (TLS) 1.3, the latest and most secure version of the protocol. This prevents interception or eavesdropping on communications.
Encryption at Rest:Student education records, session transcripts, and all sensitive data stored in our databases are encrypted using AES-256 encryption, the same standard used by government agencies and financial institutions.
Key Management:Encryption keys are managed using industry-standard key management services with automatic rotation, hardware security modules (HSMs), and strict access controls.
Database Security:Production databases are isolated from public internet access, require authenticated connections, and maintain encrypted backups stored in geographically distributed locations.
Authentication & Access Control
Password Security:We enforce strong password requirements including minimum length, complexity rules, and checks against common password databases. Passwords are hashed using bcrypt with high computational cost factors.
Multi-Factor Authentication (MFA):Optional two-factor authentication is available for all users, with support for authenticator apps (TOTP) providing an additional layer of account security.
Session Management:User sessions expire after periods of inactivity, use secure session tokens, and are invalidated upon password changes or explicit logout. Sessions cannot be hijacked or replayed.
Role-Based Access Control (RBAC):Users are assigned specific roles (student, instructor, administrator) with granular permissions. Users can only access data they're explicitly authorized to view.
Single Sign-On (SSO):For institutional customers, we support SAML 2.0 and OAuth 2.0 integration with campus identity providers, allowing secure authentication through existing university credentials.
Infrastructure Security
Cloud Provider:CasePlay is hosted on enterprise-grade cloud infrastructure that maintains SOC 2 Type II, ISO 27001, and other security certifications. Our providers undergo regular third-party security audits.
Network Isolation:Production systems are isolated in private networks with restricted ingress/egress rules. Only necessary ports and protocols are exposed, with all others blocked by default.
DDoS Protection:Distributed Denial of Service (DDoS) mitigation is enabled at the network edge to protect against volumetric attacks and ensure service availability.
Automated Backups:Encrypted database backups are performed automatically every 24 hours with point-in-time recovery capability.
Disaster Recovery:Redundant backup systems and documented recovery procedures are maintained to minimize potential downtime.
Application Security
Secure Development Lifecycle:Our development team follows secure coding practices with code reviews, static analysis, and security testing integrated into the CI/CD pipeline.
Input Validation:All user inputs are validated and sanitized to prevent injection attacks including SQL injection, cross-site scripting (XSS), and cross-site request forgery (CSRF).
Dependency Management:Third-party libraries and dependencies are regularly updated and scanned for known vulnerabilities. Critical security patches are managed through an internal prioritization process based on risk and impact.
API Security:API endpoints use authentication tokens, rate limiting, and input validation. Sensitive operations require additional verification and audit logging.
Security Headers:Our application implements security headers including Content Security Policy (CSP), HTTP Strict Transport Security (HSTS), and X-Frame-Options to prevent common web vulnerabilities.
Monitoring & Incident Response
Monitoring:Platform monitoring utilizes automated detection tools to alert the security team of anomalous behavior
Intrusion Detection:Intrusion detection and prevention systems are utilized to identify and mitigate malicious activity.
Audit Logging:System event logging is maintained to assist in security investigations and audit requirements.
Incident Response Plan:We maintain a documented incident response plan that defines roles, procedures, and communication protocols for security incidents.
Breach Notification:In the unlikely event of a data breach, we have procedures to notify affected users and institutions without undue delay and in accordance with applicable data breach notification laws.
Employee Security & Training
Background Checks:Personnel with access to production systems are subject to screening procedures.
Security Training:Every employee completes security awareness training covering data protection, FERPA compliance, phishing awareness, and incident reporting procedures.
Access Policies:Access to production systems follows the principle of least privilege and is restricted to essential personnel.
Confidentiality Agreements:All employees sign confidentiality and non-disclosure agreements protecting student educational records and institutional information.
Secure Development Training:Engineering staff receive specialized training in secure coding practices, OWASP Top 10 vulnerabilities, and security testing methodologies.
Compliance & Industry Standards
FERPA-Aligned Practices
Designed with student privacy in mind to help educational institutions meet their data protection requirements.
Privacy-First Design
Systems are engineered to minimize data collection and prioritize user privacy. Architecture follows core privacy principles to ensure data is handled responsibly and securely.
SOC 2 Type II Infrastructure
Hosted on cloud infrastructure that maintains SOC 2 Type II certification, demonstrating rigorous controls for security, availability, and confidentiality.
Security Roadmap
Internal security goals are informed by industry-standard frameworks to ensure a structured approach to data protection.
Age-Appropriate Safeguards
Architecture follows privacy principles to protect younger users. The platform is designed for adult learners and does not intentionally collect data from children under 13.
Commitment to Accessibility
Platform development prioritizes inclusive design to support students with disabilities as we work toward industry accessibility standards.
Security FAQs
Where is my data stored?
All user data is stored in secure, encrypted databases hosted on SOC 2 Type II certified cloud infrastructure in the United States. Data is not transferred outside the US without explicit consent.
Can CasePlay employees see my practice sessions?
No. CasePlay employees do not have access to view individual user practice sessions or session content except when explicitly required for technical support (with user permission) or legal compliance.
How long do you retain user data?
Active accounts retain data as long as the account is active. Users can delete their data at any time through account settings. For institutional accounts, data retention follows the institution's policies. After account deletion, data is permanently removed within 30 days.
What happens if CasePlay experiences a security breach?
We have documented incident response procedures including immediate containment, investigation, remediation, and notification. Affected users and organizations would be notified without undue delay with details about the breach, data affected, and remediation steps.
Do you share user data with third parties?
No. We do not sell, rent, or share user data with third parties for marketing or commercial purposes. We only work with carefully vetted service providers (e.g., cloud hosting, email delivery) who are bound by confidentiality agreements and data processing agreements.
How do you secure the AI models used for therapy simulation?
Our AI models are accessed through secure APIs with authentication, encryption, and data minimization practices. User inputs are not used to train public AI models. Conversation data is processed securely and deleted from AI provider systems according to data processing agreements.
Can I use CasePlay for real client data?
No. CasePlay is designed for training and skill development only, not for managing real client information or protected health information (PHI). The platform should only be used with simulated scenarios and practice cases.
Is CasePlay HIPAA compliant?
CasePlay is not intended for use with protected health information (PHI) and is not HIPAA compliant. The platform is designed exclusively for training purposes with simulated clients, not real patient care or clinical documentation.
Questions About Our Security Practices?
Our security team is available to discuss our practices, provide additional documentation, or address specific security requirements for your institution.
Contact Security Team