Trust & security
Your health story stays yours.
Chrysalis holds some of the most personal information there is. Here's how we protect it, what you control, and where we are on certification.
Where we are today
Some protections are in place now. Others are formal audits that are still underway. Each one shows its current status.
Independent audit of our security controls is underway. Report available under NDA to qualified partners on request.
Aligning controls and agreements for regulated health contexts as part of our HHS Invisible Illness work.
Data is encrypted in transit and at rest; vaults remain unreadable until access is granted.
We don't train models on user or client content.
You can export or permanently delete your data. See our Data Deletion Policy for the full process and timelines.
Scoped, revocable permissions on every Space, visible to the person at all times.
You decide who sees what.
Your Space is yours. Sharing is something you choose, one person at a time, and you can change your mind.
What you control
- 01Choose what you sharePick what goes to each person on your care team, and keep the rest private.
- 02Review it firstRead, edit or decline anything before it leaves your Space.
- 03Take access backRemove someone's access at any time, without filing a request.
- 04Ask for a copy, or delete itRequest a copy of your data, or ask us to delete it. How deletion works
What we don't do
- ×Sell your informationYour data isn't for sale, to advertisers or anyone else.
- ×Train AI on your storyWe don't use your health information to train AI models.
- ×Share without your OKYour care team sees only what you choose to send them.
- ×Hide who has accessYou can see who you've shared with, and what they can see.
Under the hood
The security details, for the people who ask.
If you evaluate vendors for a living, here's the short version of how the platform is built. A deeper architecture brief is available under NDA.
Each person and program has its own encrypted vault. Access is granted per Space and stays unreadable until it is.
Data is encrypted in transit and at rest, with key management separated from application access.
Internal access is scoped and logged. No standing access to user or client content by default.
Your data isn't used to train models and isn't sold or shared beyond the access you grant.
Permissions are enforced in the architecture, so a revoked Space can't quietly keep reading.
Security questionnaires, our SOC 2 report (once complete), and an architecture brief are available under NDA. Email security@chrysalis.inc.
For practitioners and educators
Your protocol stays yours, too.
When you bring your plan of care or program into Chrysalis, you keep ownership of it. We license it to deliver to your people, and we don't train AI models on it.
For practitioners →How to reach us
Three clear channels: everyday support, data requests and security. Each one is answered by a person.
Questions and help
Questions about your account, a Space, or how something works. Email us and a real person gets back to you.
chrysalis@chrysalis.inc → Data requests · export or delete, anytimeCopy or delete your data
Ask for a copy of your data, or request that we delete it. See the full process and submit a request.
Data deletion policy → Security & privacy · priority handlingReport a concern
Report a vulnerability, a privacy issue, or anything touching health information (PHI). Monitored, and not behind a login.
security@chrysalis.inc →Help center
Search our FAQ
Answers to the questions people ask most: data handling, response times, deletion, and how to reach us. No login required.
How does Chrysalis handle my data?
Your data lives in an encrypted vault that stays unreadable until you grant access. You decide what enters a Space, who can see it, and for how long. We don't sell your data, and we don't use it to train models.
Data & privacyDo you train AI models on my data?
No. We don't train models on user or client content. Your context is used only to serve you and the relationships you explicitly grant access to.
Data & privacyIs my data encrypted, and who can read it?
Data is encrypted in transit and at rest. Vaults remain unreadable until access is granted, and internal access is scoped and logged. There's no standing access to your content by default.
Data & privacyWho owns my context and memory?
You do. Each person's context belongs to them; a business's IP belongs to the business. They're governed separately, not blended into a pool someone else controls.
Data & privacyHow do I delete my data?
You can permanently delete your data at any time. Email chrysalis@chrysalis.inc to request it, and see our Data Deletion Policy for the process and timelines. This maps to GDPR Art. 17 and our HIPAA obligations.
Deletion & rightsHow long does a deletion request take?
We confirm receipt within 2 business days and complete verified deletions within the window documented in our Data Deletion Policy. You'll receive confirmation when it's done.
Deletion & rightsCan I export a copy of my data?
Yes. You can export a full, portable copy of your context and memory at any time, so ownership is something you can actually act on.
Deletion & rightsHow do I revoke access I've already granted?
Open the Space and revoke its access. It takes effect immediately, with no support ticket required. A revoked Space can't quietly keep reading, because permissions are enforced in the architecture.
Deletion & rightsHow do I report a security or privacy concern?
Email security@chrysalis.inc. It's monitored and easy to reach. See the Security & privacy channel above, especially for anything touching health information (PHI).
SecurityWhat happens if there's a breach?
We maintain an incident response process and, where required by law and our HIPAA obligations, will notify affected users and authorities within mandated timelines. Report anything you notice to security@chrysalis.inc.
SecurityHow do I contact support?
Email chrysalis@chrysalis.inc and a real person gets back to you. See How to reach us for every way to reach us.
SupportWhat are your response times?
We reply to support requests within 2 business days, and confirm data and security requests within the same window. Urgent security matters should go to security@chrysalis.inc.
SupportAre you SOC 2 and HIPAA compliant?
Both are in progress. Our SOC 2 Type II audit is underway, and we're aligning HIPAA controls and agreements as part of our HHS Invisible Illness work. We expect both in November 2026. Encryption, no-training, consent controls, and data deletion are active in the product today.
ComplianceDo you have a documented data deletion policy?
Yes, and it's public. Read the Data Deletion Policy for the process, timelines, and how to submit a request.
ComplianceNo matches. Try another word, or email chrysalis@chrysalis.inc.
Security disclosures: security@chrysalis.inc