Data security is just as important as assessment quality.
Seneca is built for the sensitive nature of autism assessments. Your records are hosted in Ireland, protected by strict access controls, and never used to train AI models. Here's exactly how we protect, process and delete your data.
Five facts about your clients' data
Hosted and stored in the EU
Hosted on Vercel (Dublin); the database runs in Ireland (eu-west-1).
Your patients' data never trains an AI model
Drafting and transcription run on the Anthropic and OpenAI APIs, whose published terms exclude API inputs and outputs from model training; Seneca is not opted into either provider's data-sharing programme.
The clinician is the author of record
No report can be exported without explicit, per-section sign-off.
Deletion actually deletes
Right-to-erasure is a hard delete at the data model level, not an archival flag.
Every draft is traceable
Every AI-generated section is logged against the model, prompt version and the inputs used.
What's covered, one topic at a time
Scroll through, or jump straight to what you came to check.
How data is protected
Access and isolation
- Access is enforced in the database, default-deny, not by application checks
- A clinician reaches a case only through membership of that case's team
- Privileged database credentials are server-side only and never used to skip an authorisation check
- Developer and AI-agent database tooling is read-only and points only at a project holding test data
Data protection
- Encryption in transit and at rest
- Database and file storage in Ireland; application compute in Dublin
- Clinical content is kept out of technical logs, error messages and URLs
- Soft delete by default, with a separate, deliberate, audited erasure path
- Erasure purges stored files as well as database rows, because file storage is not covered by a database cascade
- One-click export of everything held about a client, for a portability request
Accountability
- An audit entry on every state-changing action: create, edit, view of a sensitive record, export, sign-off and erasure
- The audit trail is append-only at the database privilege level — it cannot be edited or truncated, including by us
- The audit trail is deliberately not erased with a client, so it survives as proof of what was erased, by whom and when
- It carries no clinical content and no assessed person's name, which is what makes keeping it permanently lawful
Application security
- Untrusted content — uploaded documents, transcripts, model output — is sanitised on write and on render, not on one of the two
- Rate limiting on the expensive and abusable routes
- Uploaded files are checked by type, and the store accepts no audio or video type at all
AI and your patients' data
- Every model call writes a row recording model, prompt version, inputs, output, tokens, latency and who triggered it
- Prompt versions are pinned and bumped rather than edited in place, so any past draft is reproducible
- Clinician sign-off is required per section and is immutable unless deliberately unlocked
- The drafting prompt requires every clinical claim to trace to a specific input; missing data is flagged as a gap, never invented
- AI-drafted content is labelled as such in the interface
Do the AI providers train on my clients' data?
No. Both providers are under contracts that exclude our inputs and outputs from model training, and Seneca is not enrolled in either provider's data-sharing programme. The drafting provider holds inputs and outputs for 30 days on our account and then deletes them. The transcription endpoint keeps nothing at all.
What about hallucinations — can the draft invent something?
It can, which is why the product is built around you catching it rather than around us promising it will not happen. Three things narrow the risk. The drafting prompt requires every clinical claim to trace to a specific input, and requires missing data to be flagged as a gap rather than filled in. Each drafted statement carries the record it came from, so checking it is reading, not detective work. And nothing reaches a family without your sign-off on every section. A tool that could finalise a report without you would be a different and much more dangerous product.
Retention and your rights
Two different things, kept separate on purpose. The routine delete hides the case and preserves the record, because Irish clinical records are normally kept for around eight years after last contact and an accidental delete of a clinical record is a serious problem. Erasure is the separate, deliberate path for a right-to-be-forgotten request: you re-type the client's exact name, the uploaded files are purged from storage first, an erasure record is written to the audit trail, and then the case and everything attached to it is deleted. That one cannot be undone, by you or by us. The audit trail survives on purpose, and carries no clinical content and no assessed person's name.
Where the data physically sits
Two steps send case data out to be processed, and nothing is stored there. Both are named below, with what each provider may keep.
- The databaseEvery case, score, note and report. Ireland (eu-west-1).
- Uploaded documentsSchool reports, letters, previous assessments. Irish storage.
- The application itselfThe site and the app run on servers in Dublin.
Report drafting
Anthropic, United States
- What is sent
- Only the case data the section being drafted needs. Not the whole record.
- What they keep
- Not used to train a model. Held for 30 days on our account, then deleted.
Transcription
OpenAI, United States
- What is sent
- The session audio, straight from your browser.
- What they keep
- Nothing. Not the audio, not the text it produces.
Both transfers run on the European Commission's standard contractual clauses, with a written transfer assessment behind them. Transcription is contracted with the provider's Irish entity.
Who else can touch it
Billing, sign-in email and website analytics use other providers, alongside the two named above. All seven are listed, with what each one may keep, in the sub-processor register.
Documents you can request
These nine documents exist today. Email hello@senecadocs.com for any of them and we answer with the document rather than a call.
- The processing agreement, with its schedules
- Sub-processor register
- Record of processing activities
- Transfer assessment
- Retention schedule
- Breach procedure and notification template
- Data subject request procedure
- A DPIA template for your practice
- Intended purpose statement
If something goes wrong
There is a written breach procedure and notification template.
What happens in the first 72 hours, who is told in what order, and what you receive.
Email hello@senecadocs.com for the document itself.
What clinicians ask us first
Is the session audio recorded and kept?
No. If you record a session, the audio is held in your browser's memory, sent to be transcribed, and dropped. It is never written to our file storage, never written to a table and never written to disk, and the transcription provider keeps neither the audio nor the text it produces. The transcript is kept, because you need it. An automated test fails the build if any code appears that would store audio anywhere.
Can anyone at Seneca read my clients' records?
Access to the live database is restricted to the operator of the service and is not used for routine support. We will not open a case file to answer a support question — we ask you what you are seeing instead. The tooling developers and AI agents work with is read-only and points at a separate project holding test data, never real records. That rule exists because the product takes in documents from outside, and an assistant with real patient data, untrusted content and a way to write is the failure worth designing against.
Do the AI providers train on my clients' data?
No. Both providers are under contracts that exclude our inputs and outputs from model training, and Seneca is not enrolled in either provider's data-sharing programme. The drafting provider holds inputs and outputs for 30 days on our account and then deletes them. The transcription endpoint keeps nothing at all.
Where is the data stored, and does any of it go outside the EU?
Storage is in Ireland. The database, the uploaded documents and the application all run there. Two processing steps run in the United States: report drafting and audio transcription. Both run on the European Commission's standard contractual clauses, with a written transfer assessment behind them that we will send you, and transcription is contracted with the provider's Irish entity.
What happens when I delete a case, or when a family asks to be forgotten?
Two different things, kept separate on purpose. The routine delete hides the case and preserves the record, because Irish clinical records are normally kept for around eight years after last contact and an accidental delete of a clinical record is a serious problem. Erasure is the separate, deliberate path for a right-to-be-forgotten request: you re-type the client's exact name, the uploaded files are purged from storage first, an erasure record is written to the audit trail, and then the case and everything attached to it is deleted. That one cannot be undone, by you or by us. The audit trail survives on purpose, and carries no clinical content and no assessed person's name.
What about hallucinations — can the draft invent something?
It can, which is why the product is built around you catching it rather than around us promising it will not happen. Three things narrow the risk. The drafting prompt requires every clinical claim to trace to a specific input, and requires missing data to be flagged as a gap rather than filled in. Each drafted statement carries the record it came from, so checking it is reading, not detective work. And nothing reaches a family without your sign-off on every section. A tool that could finalise a report without you would be a different and much more dangerous product.
You have read how it works
now see what it writes
If anything above is not the answer you needed, ask us the harder question — we would rather have it now than after you have signed up.