Security
How access is actually enforced.
Specific enough to be checked. Where something is not in place, it says so rather than leaving the shape of a claim.
Row-level isolation, enforced by the database
Every table denies by default and grants access only to rows belonging to the signed-in user, enforced by the database itself rather than by application code that could forget. The join table between entries and themes checks both sides on every operation, so a request cannot attach someone else’s label to its own row and read that label back out.
The policies are tested by a suite that asserts a second user is proven unable to read a row that demonstrably exists, not merely that a query came back empty. An empty result is what a policy suite returns when there are no policies at all.
Share links
Thirty-two bytes from a cryptographic random source. Only a SHA-256 hash of the token is stored, so no read of the database, by us or by a backup or by anyone who reaches the table, can reconstruct a working link.
A shared sheet is served by a single database function that validates the hash, the expiry and the revocation, and returns the same nothing for expired, withdrawn and never-existed. Anonymous access has no permission on any table, in any mode. It may call five database functions and nothing else: the two that serve a single shared page, and the three that serve a clinician’s standing link. Every one of them takes a token and returns a frozen document; none of them can be asked a question about anybody.
Why a shared link shows a button before it shows anything
Mail gateways, link scanners and chat clients fetch a URL when it is delivered, well before a human opens it. So the first page carries no patient content at all, just a name, a date and a button. A view is counted only when the button is pressed. Without that, the app would report a therapist reading somebody’s private writing at 6am when what actually happened was a mail filter.
Keys
The privileged database key exists only on the server, is never present in a web bundle or a mobile build, and the shared code throws if it is read from a client at all. A build in which a secret has been given a public prefix, the one typo that turns a private key into a published one and produces no error of its own, fails rather than ships.
On the device, when there is a mobile app
The mobile app has not been released yet. Everything in this section is how it is built and configured today, not something you can install and check. We would rather state that than describe an unshipped app in the present tense.
The session token is held in the iOS Keychain and the Android Keystore, not in app storage, which is a plaintext file readable in a backup or on a rooted device. Optional biometric lock. Private mode swaps the icon for a neutral one, replaces notification text regardless of the OS preview setting, and blanks the app-switcher snapshot. It does not change the app’s name, because iOS does not permit an app to do that, and the setting says so.
Third parties
Supabase for the database and authentication. Vercel for hosting. Resend for email. OpenAI, only for accounts that have turned pattern-finding on, under a zero-retention agreement. That is the complete list.
There are no advertising SDKs and there never will be. The FTC action against BetterHelp over ad-tracking disclosure is the cautionary tale for this entire category. There is also no product analytics package of any kind at present — no third-party tag, no session recorder, nothing counting what you click. If that ever changes it will be self-hosted and blocked from seeing the content of anything you write, and this page will say so before it ships rather than after.
What is not in place
No SOC 2 report. An evidence trail is being kept from the start, but the audit has not been done and we will not imply otherwise.
We are almost certainly not a HIPAA covered entity in this form, a consumer notebook where the patient controls every disclosure, and we do not sign business associate agreements today. The system is built as though we will need to, because the day a clinician tier exists that changes, and retrofitting it costs a year.
No penetration test yet. When there is one, the date will be on this page.
Reporting something
If you have found a problem, write to security@theother10k.com. We will confirm receipt within two working days, we will not threaten anyone acting in good faith, and we will credit you if you want the credit.