How HopeLinx protects your information

This page describes the safeguards HopeLinx uses, in plain words, and what HopeLinx does and does not claim about HIPAA. It is written for the staff and residents who use HopeLinx and for the organizations that run it.

Encryption

• In transit. Every connection to HopeLinx uses HTTPS (TLS 1.2 or newer). HopeLinx is reached through Cloudflare's network, which also filters hostile traffic before it reaches the server.
• At rest. The database (MongoDB Atlas) and file storage (Amazon Web Services) encrypt everything stored, including backups.

Who can see what

• Every staff member has a role, and each role is a set of permissions: what they can see, add, change and delete. Organizations set these themselves.
• Staff can be limited to the properties they work at.
• Private information (government ID numbers, health, legal and money details) is a separate set of permissions, off unless an organization turns it on for a role.
• Residents see only their own records.
• HopeLinx staff do not look at an organization's records except to provide support an organization asks for, to keep the service running, or when the law requires it.

Accounts and sign-in

• Passwords are stored only as one-way hashes (bcrypt); nobody at HopeLinx can read them.
• Passwords must meet minimum strength rules, and reset links expire.
• Two-step verification is available to every account: a code by email or text, with backup codes.
• Sessions expire after 24 hours. Sign-ins are recorded with the time, IP address and device so an unexpected sign-in can be spotted.
• Sign-in and other requests are rate-limited to slow down guessing.

Activity history

Changes to a resident's record are recorded with who made them and when. Changes to roles and permissions are kept in a history an organization can review. Views of resident locations in the Tracker are recorded.

Backups

The database is backed up every day, encrypted, and each backup is kept for 8 days.

Payments

Payments are processed by Stripe, a PCI DSS Level 1 service provider. Card and bank details are entered in Stripe's own payment fields and go straight to Stripe. HopeLinx stores only what a receipt needs, such as the card brand and last four digits, never a full card number.

Texts and emails

Texts are sent through Twilio and emails through our email delivery provider, only when an organization sets up a reminder, code, receipt or notice. Anyone can stop texts by replying STOP.

HopeLinx AI

When an organization turns on HopeLinx AI, the records a staff member is allowed to see are sent to OpenAI to produce an answer, under a Business Associate Agreement and a zero-data-retention arrangement: OpenAI does not store the information after answering and does not use it to train its models. Every change HopeLinx AI proposes waits for a staff member's approval.

Product analytics

HopeLinx sends us usage and error information through PostHog so we can keep it working and improve it. Resident information and everything typed are masked on the device before anything is sent. Recordings are kept for no more than 90 days, and an organization can turn resident recordings off in Settings → Features. The full description is in the Privacy Notice.

Where the information lives

In the United States: servers, database, file storage and backups.

Keeping HopeLinx current

Every organization runs the same, current version of HopeLinx; security fixes reach every organization in the same update. We monitor errors and failed requests across the service, and the software's dependencies are reviewed and updated regularly.

HIPAA and 42 CFR Part 2

There is no government certification for "HIPAA compliance", and HopeLinx does not claim one. What we can tell you is what HopeLinx does:

• Whether HIPAA applies is your organization's determination. A recovery residence that provides housing and peer support, does not provide treatment and does not bill insurance is usually not a HIPAA covered entity. One that provides or bills for clinical services may be, and a program that provides federally assisted substance use disorder treatment is subject to 42 CFR Part 2 (the rules protecting substance use disorder records, which HHS aligned with HIPAA in a rule that took effect February 16, 2026). If you are not sure, ask a healthcare attorney.
• If HIPAA applies to your organization, HopeLinx enters into a Business Associate Agreement with it. Ask us at info@hopelinx.com before storing protected health information, as our Terms & Conditions of Service require.
• Our service providers. HopeLinx AI runs under a Business Associate Agreement with OpenAI with zero data retention. We are putting Business Associate Agreements in place with our other service providers that handle stored information.
• Safeguards. The encryption, access controls, account protection, activity history and backups described above are the technical safeguards HopeLinx applies to every organization, whether or not HIPAA applies to it.
• If something goes wrong. If we learn of a security incident affecting an organization's information, we tell that organization without unreasonable delay and within the time the law and our agreements require, with what we know and what we are doing about it. The organization remains responsible for any notices it must give to the people affected.
• Disclosures. HopeLinx does not disclose an organization's records outside that organization except as its service provider, when the law requires it, or as described in the Privacy Notice. Consents and disclosures that HIPAA or Part 2 require remain your organization's responsibility.

Reporting a security concern

If you believe you have found a security problem in HopeLinx, email info@hopelinx.com. We treat reports confidentially and respond as quickly as we can.