Security & privacy
Last reviewed July 25, 2026 · hello@junie.app
Junie does not currently offer a BAA
If you are a HIPAA covered entity or business associate, do not use Junie to create, receive, maintain, or transmit protected health information on your behalf. Junie does not claim HIPAA compliance. The U.S. Department of Health and Human Services explains who HIPAA covers. Ask a qualified advisor if you are unsure about your practice.
Below is the current implementation, based on the application code and production configuration. Planned work is listed separately so it cannot be mistaken for a control that exists today.
Implemented today
Implemented
Public connections
Junie's public website and app use HTTPS and HSTS. App responses also set frame, content-type, referrer, camera, microphone, and location restrictions through security headers.
Implemented
Practice separation
Account-scoped database tables use PostgreSQL row-level security. Production app connections use a non-superuser role that cannot bypass those rules. An automated coverage test fails if a new account table ships without an isolation decision.
Implemented
Encryption at rest
Google Cloud AlloyDB encrypts the production database and backups at rest with Google-managed keys. Private client notes and optional birth notes also use application-level AES-256-GCM encryption with a separate data key for each practice.
Implemented
Client-access links
Client hub links use 256-bit random tokens. Junie stores a SHA-256 hash instead of the token, expires a link after 30 days without use, and lets the practice revoke its client links. A link exchanges for a client-scoped session that lasts up to 24 hours.
Implemented
Payments
Client charges run directly on the practice's Stripe Standard connected account. Full card and bank-account numbers go to Stripe, not Junie's database. Stripe-signed webhooks are verified before payment events are applied.
Implemented
Export and deletion
An account holder can download a ZIP with the listed CSV records and HTML copies of executed contracts and generated receipts. The current export omits private notes, birth-event details, packages, templates, setup artifacts, and imported source files. Junie has not verified that the in-app deletion control works with production permissions; email a deletion request instead of relying on that control for now. Fourteen daily backup copies rotate separately.
Implemented
Change records
Junie records account activity such as record creation, status changes, sends, payments, and link revocation in account-scoped audit logs. Executed documents carry a content hash that Junie verifies before serving the document.
Implemented
Production workload
The web workload runs as a non-root user with a read-only container filesystem, dropped Linux capabilities, and restricted network access. Secrets are supplied at runtime rather than stored in the source repository.
AI data handling
Junie's AI integrations support the Anthropic and OpenAI commercial APIs. An enabled inquiry-drafting workflow sends the base draft and the family's inquiry text to the configured provider. That text may contain sensitive details the writer chose to include. Junie does not use account or client records to train its own models. Both providers state that commercial API inputs and outputs are not used for model training by default, but standard retention and abuse monitoring may apply. Junie does not claim Zero Data Retention or a HIPAA BAA with either provider. See the Privacy Policy for the full data flow.
Planned or not yet available
Not implemented
Business Associate Agreements
Not available. A BAA requires Junie and every relevant provider in the data path to support the required agreement and configuration. There is no launch date to rely on yet.
Not implemented
Two-factor authentication
Not implemented for Junie accounts. Account holders can review and revoke active sessions today.
Not implemented
Content Security Policy
Not implemented. Junie currently sets baseline security headers, but a nonce-based Content Security Policy still needs application work.
Not implemented
Required TLS for the database connection
Not implemented. The app reaches AlloyDB over a restricted private cloud network, but the database does not yet require TLS on that internal connection.
What we do not claim
Junie is not HIPAA compliant, SOC 2 certified, or presented as independently penetration tested. The controls above reduce risk but do not make any online service perfectly secure. We will add a certification or independent-assessment claim only after that work is complete and can be verified.
Data lifecycle
Canceling a paid subscription stops a future renewal according to Stripe's billing settings; it does not delete the Junie account. Export is available while the account exists. The in-app deletion control has not been verified with production permissions, so cancel the subscription, export, and email hello@junie.app with a deletion request. Security, payment, dispute, tax, legal, email suppression, and provider records may have separate retention requirements. Fixed database backups age out as the 14 daily copies rotate. The Privacy Policy has the complete explanation.
Report a security concern
Email hello@junie.app with "Security" in the subject. Include the affected URL, what you observed, and steps to reproduce it. Do not include client records or attempt to access another person's data while testing.