A kiddo’s record is the most sensitive thing you hold.

One clinic cannot reach another clinic’s records.

Every operational row carries the organisation that owns it, and Row Level Security decides what a query is allowed to return before the application sees a single row. That distinction matters: an application bug that forgets a filter returns nothing rather than somebody else’s data, because the boundary is underneath the bug.

• 231 tables have row-level security enabled, carrying 646 policies between them.
• Cross-organisation requests are part of the required test suite, and are expected to return no rows rather than an error — an error is itself a disclosure.
• Cue’s own staff are separated from clinic users by a different mechanism entirely, so support cannot quietly become one of your people.

Authorisation is layered, and no layer is the browser.

Four checks stand between a request and a record: the route gate in the app, a server-side role check in the API, the row-level policy in the database, and a separate platform-admin check for anything belonging to Cue rather than to a clinic. No sensitive behaviour depends on client-side filtering — hiding a button is not a permission.

Encrypted in transit, at rest, and again at the field.

Transport and storage encryption are table stakes and are in place. On top of them, the fields that actually identify a child are encrypted individually with AES-256-GCM, so a value is self-contained: its own initialisation vector, its own authentication tag, its own ciphertext. GCM is authenticated encryption — a tampered value fails to decrypt rather than decrypting to something plausible.

• Encrypted at the field level: first and last names, dates of birth, contact phone and email, and social security numbers where they are held at all.
• The key is never in the codebase. It is supplied to the running environment and read from there.
• It fails closed. A malformed key always throws. A missing key throws in production rather than falling back to writing plaintext — a misconfiguration stops the write instead of quietly storing a name in the clear.

You can find out who looked, and nobody can unfind it.

PHI access and mutation are written to an audit log through one shared path, recording the organisation, the user, the action, the kind of record and its id. The interesting property is not that the log exists — every platform has a log — it is what the database will let you do to it.

Because RLS denies anything a policy does not explicitly allow, the absence of those two policies is the guarantee. The log is append-only at the database level, not by convention and not because the application declines to offer a delete button.

Sessions happen in classrooms, living rooms and cars. A trial recorded where there is no signal is written to the device first, before any network call is attempted, and survives a closed tab or a restarted app. A failed sync marks the session as still waiting, never as done — and the BCBA who has to sign it off is told, in their action queue, in the app and on their phone, so the session is closed properly rather than left for somebody to notice.

The part that matters for billing integrity: every session carries its own identifier, and a replay updates the record it already created rather than creating a second one. There is no time bound on that match, so a session that reaches us days late still cannot bill a visit twice. The full protocol →

The model provider is a Business Associate, or it does not see anything.

Cue uses a language model to write the daily brief and to draft from what a clinician already recorded. Using AI on PHI is not the violation; sending PHI to any vendor without a Business Associate Agreement is the violation. So the agreement comes first, and the covered surface is written down rather than assumed.

• Model features Cue uses are inside the agreement’s covered surface. Features outside it are not adopted, however convenient — two of them would have made specific jobs easier and were declined for exactly this reason.
• PHI never appears in a structured output schema — not in property names, not in descriptions, not in examples.
• Inputs and outputs are not used to train anyone’s model.

The clock is in the software, not in somebody’s calendar.

Cue acts as your Business Associate. If we discover an incident affecting your organisation’s data, the notification duty under 45 CFR §164.410 is ours, and the platform tracks it rather than leaving it to memory.

• The affected clinic’s owner is notified within 60 days of discovery, with the severity and what is known.
• The notice carries the HHS deadline as a date and a countdown, and turns red inside the last fortnight.
• It states your own obligations plainly: as the Covered Entity you notify affected individuals within 60 days, and where 500 or more individuals in a state are affected, prominent media notification may also be required.

Controls are only worth what the evidence behind them is worth.

Everything above is implemented and can be pointed at. Being straight about the rest: Cue does not hold a SOC 2 or HITRUST attestation today, and no page on this site will imply one. What exists is an internal evidence programme that turns each control into something repeatable rather than something asserted once.

Runs are recorded rather than remembered. If you are evaluating Cue for a clinic and your reviewer needs the detail, ask and we will send the evidence package.