Security and trust
Built to hold recordings for minutes, not months.
The safest data is data we no longer have. Here is exactly what Driveway keeps, for how long, and who can reach it.
No card. 10 notes a month free. First note in under a minute.
Data handling
- Audio is deleted the moment a note is written, and no later than 24 hours by a scheduled sweep.
- Transcripts are deleted 30 days after creation.
- Notes stay until you delete them. Deleting a client, session, or note removes everything attached to it.
- Account deletion removes all of your data within 24 hours.
Access control
- Every table is protected by row-level security in the database. A clinician can only reach their own clients, sessions, and notes.
- The browser never holds a privileged key.
- Team admins see usage counts. Note access for admins is off by default and can only be turned on by the org owner.
- Upload links expire after 10 minutes and point at a private bucket keyed by session id only.
Encryption and infrastructure
- TLS in transit; encryption at rest for the database and storage.
- Hosted on Vercel and Supabase in the United States.
- Strict Content Security Policy, HSTS, and frame denial on every page.
Auditing
- Every note view, export, insertion, and deletion is logged with a hashed client address.
- Every generated note runs through a second model pass that lists claims not supported by the transcript, so unsupported numbers are visible before signing.
AI processing
- Paid plans are transcribed and drafted only by providers under a Business Associate Agreement with us.
- The free plan may use a transcription provider without a BAA and is not intended for sessions that require one; the app says so on the record screen.
- Model output is validated against a strict schema for each template before it is stored.
- Nothing from a recording, transcript, note, or client preset is ever sent to analytics, error reporting, email, or SMS.
Business Associate Agreement
- Pro and Team plans include a signed BAA, accepted with a timestamp during onboarding.
- Subcontractors that touch protected information are bound in writing to the same terms.
Report a concern
If you believe you have found a security issue, use the contact form and choose Security. We read those first and reply within two business days.
Read the full policies.
No card. 10 notes a month free. First note in under a minute.