Why we pursued five compliance certifications, built regional data residency, and made security the foundation of everything we do.
By Stephen Stearman, CEO, Psynth
A BAA Is Not Enough
Most psychologists I speak with believe they are covered on data security because their software vendor signed a Business Associate Agreement. A BAA is a contract. It says a vendor agrees to protect your patients' data. It does not prove they actually can. There is no audit behind it. No third-party verification. No evidence that the vendor has implemented the technical safeguards, access controls, and encryption standards that HIPAA actually requires.
When you are handling psychological evaluation data (full-scale IQ scores, behavioral observations, diagnostic impressions, trauma histories) you are dealing with some of the most sensitive protected health information in all of healthcare. A handshake agreement is not proportional to the risk. If your current vendor cannot show you a third-party audit, you are trusting a promise, not a proof.
That is why Psynth made the decision to go beyond the BAA. We pursued third-party verified compliance across five major frameworks. Not because a customer asked. Because the data demands it.
Where Psynth Stands Today
As of February 2026, Psynth has achieved third-party verified compliance for:
- HIPAA - Verified compliant. Signed BAAs with all downstream vendors. End-to-end encryption, role-based access controls, audit logging, and zero-retention AI models.
- PIPEDA - Verified compliant. Full adherence to Canada's Personal Information Protection and Electronic Documents Act, with data residency in Ontario, Canada.
- GDPR - Verified compliant. Full adherence to the EU's General Data Protection Regulation, with data residency in Dublin, Ireland.
- SOC 2 Type 2 - Currently in the observation period. Expected completion: May 2026.
- ISO 27001 - Internal audit complete. Certification expected by end of March 2026.
All certifications are verified by Glocert, an accredited third-party auditor. Every policy, control, and procedure is documented and available for review at trust.psynth.ai.
Why We Did the Hard Work
Pursuing five compliance certifications simultaneously is expensive, time-consuming, and operationally demanding for a growing company. We did it anyway. Here is why.
1. The Data Demands It
Psychological assessment data is not a billing record or an appointment note. It includes cognitive profiles, emotional functioning, behavioral patterns, family histories, and diagnostic formulations. This is the kind of information that, if mishandled, can affect a patient's insurance, employment, custody arrangements, and educational placement.
We treat this data with the gravity it deserves. Zero-retention AI models mean no patient data is stored, cached, or repurposed in our large language models. PHI is tokenized during processing. Encryption covers data at rest and in transit. These are not features we advertise for marketing. They are engineering decisions we made because anything less would be irresponsible.
2. Trust Indicators for the Market
Psychologists are trained to evaluate evidence. When a clinician evaluates Psynth, we want them to see verified proof, not marketing copy. Third-party certifications are the clinical equivalent of peer-reviewed validation. They tell you that an independent auditor examined our infrastructure, our policies, and our practices, and confirmed they meet established standards.
Our Trust Center at trust.psynth.ai makes every policy available for review. If you want to see our data handling procedures before you upload a single score, you can.
3. Derisking the Business, For You and For Us
Compliance protects both sides of the relationship. For psychologists, it reduces the risk of a data breach affecting your patients and your practice. For Psynth, it creates operational discipline: documented procedures, regular audits, continuous monitoring. That makes us a more reliable platform over time.
This is not a one-time effort. SOC 2 Type 2, for example, requires ongoing observation. ISO 27001 requires continuous improvement. We have built compliance into our operations, not bolted it on as an afterthought.
4. Opening the Enterprise Sales Channel
Solo practitioners may evaluate Psynth based on output quality and time savings. Enterprise buyers (hospital systems, large group practices, school boards, government agencies) start with security. Before they will look at a demo, they ask: Are you SOC 2 certified? Do you have a BAA? Where does the data live?
We want to be ready with a verified answer to every one of those questions. Compliance is not just a trust signal. It is a sales channel. And for organizations with procurement requirements, it is the difference between being on the shortlist and being disqualified before the conversation starts.
Data Residency: Your Patients' Data Stays Where It Belongs
Psynth is the only platform in the psychological assessment space with full data residency capabilities across multiple regions.
What this means: when a Canadian psychologist uses Psynth, their patients' data is processed and stored in Ontario, Canada. When a UK or EU-based psychologist uses Psynth, their data stays in Dublin, Ireland. The data never leaves the region.
We built this because our customers are in Canada, the UK, and Australia, and they need regional compliance, not just a checkbox on a website. Australian data residency is next on our roadmap.
This capability matters for PIPEDA, which requires that Canadian personal information be handled in accordance with Canadian privacy standards. It matters for GDPR, which restricts cross-border data transfers. And it matters for any psychologist who wants to look a patient in the eye and say, "Your data stays in this country."
We Are Here to Stay
Compliance at this level is a commitment. It is ongoing audits, penetration testing, continuous monitoring, and regular policy reviews. It is not something you pursue if you are planning to pivot to a different market next year.
Psynth is purpose-built for psychological assessment. We support over 370 standardized instruments. We work with solo practitioners, multi-clinician practices, and enterprise organizations. We are building the infrastructure to be the long-term platform for this field. Security is not a feature we added. It is the foundation we built on.
If you want to see the evidence for yourself, visit our Trust Center at trust.psynth.ai. If you are ready to see how Psynth handles your data while cutting your report writing time by 75%, book a demo or start a free trial.
Frequently Asked Questions
Is Psynth HIPAA compliant?
Yes. Psynth is fully HIPAA compliant with third-party verification by Glocert. We maintain signed BAAs with all downstream vendors, use end-to-end encryption, role-based access controls, audit logging, and zero-retention AI models. Full documentation is available at trust.psynth.ai.
What compliance certifications does Psynth have?
Psynth is third-party verified for HIPAA, PIPEDA, and GDPR. We are currently in the SOC 2 Type 2 observation period (completing May 2026) and expect ISO 27001 certification by end of March 2026.
Where is my patient data stored?
Psynth offers regional data residency. Canadian patient data is stored in Ontario, Canada. EU and UK patient data is stored in Dublin, Ireland. US patient data is stored in the United States. Australian data residency is on our roadmap. Your data never leaves the region.
Does Psynth store patient data in its AI models?
No. All AI inference is conducted using zero-retention models. No patient data is stored, cached, or used to train our AI. PHI is tokenized during processing and encrypted at rest and in transit.
Is a BAA enough to make software HIPAA compliant?
A BAA is a necessary contract, but it is not sufficient on its own. A BAA says a vendor agrees to protect your data. It does not prove they have the technical safeguards in place to actually do so. Third-party verified compliance (like the certifications Psynth holds) provides that proof.
Can I review Psynth's security policies?
Yes. Our Trust Center at trust.psynth.ai makes every policy, control, and certification status available for review.
Related Reading
