A desktop app for therapists and counsellors, designed around one rule before a single screen was built: if it is ever compromised, it should reveal as little as possible. It runs entirely on your own computer, not a cloud service.
Talk to us about early accessWhy it exists
Safer Haven Therapy Notes handles special category data under UK GDPR: clinical and personal information about people who are often at their most vulnerable. That single fact shaped the whole build. The security architecture was designed before a single screen of the interface existed, not bolted on afterwards to tick a box.
It is built in Python with a native desktop interface, packaged as one standalone Windows application. Nothing about how it protects your clients depends on a server we control or a cloud account you have to trust. It was born directly from our founder's own background in counselling, built by someone who has sat on both sides of that room.
The core design
The single biggest decision in this build: your client's identity and their clinical notes are never stored in the same place.
Real client details: name, contact information, uploaded contracts. Its own password, its own encryption.
Session notes, tied only to an anonymous code. Its own separate password, its own separate encryption.
The two passwords can never be the same. That is checked cryptographically, not as a simple text comparison, both when they are first created and every time either one is changed.
If one database is ever compromised on its own, it only ever reveals half the picture. A breach of the notes database shows clinical content tied to an anonymous code, no names attached. A breach of the contacts database shows names and contact details, no clinical content attached. Connecting the two requires both passwords. That protection lives in the architecture, not in a setting someone could switch off.
How it protects the detail
The only thing that ever passes between the two databases is a randomly generated alias: a short word-and-number code, something like "River-2209", pulled from a list of over 2,000 neutral words using a proper cryptographic random generator. You never choose it and you can never edit it, and its uniqueness is checked before it is ever written down. A code a person chose could accidentally carry meaning, or be guessed. A random one, from a pool that size, carries none. Even on the contacts side, that alias stays hidden by default. Seeing it means re-entering the contacts password there and then, a genuine second login rather than a toggle, and it hides itself again after 30 seconds.
Every part of both databases is encrypted using SQLCipher, the same AES-256 standard banks rely on. There is no master key stored anywhere in the application. Instead, the key that unlocks each database is worked out fresh at the moment you log in, from your password, using a deliberately slow process called PBKDF2, run 600,000 times over. That slowness is the point: it makes trying to force open a stolen file impractical rather than merely awkward. Each database also carries its own separate salt, stored apart from everything else. A stolen laptop, or a copied file, should mean nothing without the password.
Each side has its own recovery key: a 64-character code, shown once at setup, which you must confirm you have saved before you can carry on. Recovering access after a forgotten password works by unlocking the database's real key using that recovery key, never by quietly keeping a spare copy of your password. Changing a password retires the old recovery key automatically and issues a new one. A forgotten-password feature that secretly keeps a way round the encryption would defeat the point of having it. So the trade-off is real, and it is disclosed at setup rather than after: lose both a password and its recovery key, and that side's data is gone for good.
Every change made to a saved session note is logged: what it said before, what it says now, what changed, and when. That is not a setting you could switch off from the interface. The database itself is built so those audit entries can never be updated or deleted, by anyone, including our own code. Clinical record-keeping expects a defensible history of any amendment, so that rule lives in the database rather than depending on an interface behaving itself.
When you upload a signed contract, often a phone photo, the application strips out everything hidden inside it first: device information, GPS coordinates, timestamps. It then compresses the file and stores it as an encrypted file, and deletes the original, unprocessed photo straight afterwards. Phone photos carry far more hidden data than most people realise. Removing it before storage means that information never sits on a disk somewhere, waiting to be recovered.
The application makes no network connections during normal use. The only time it goes online is if you choose to run an encrypted backup, to a destination you set up yourself. Nothing leaves your device automatically. Local backups are also kept in a separate location from your live data, deliberately, so whatever affects one does not affect the other. This is a tool built to run on your own machine for sensitive clinical work, and keeping what leaves the device to a minimum is a genuine security choice, not a missing feature.
Where this stands, honestly
This has been built carefully and tested continuously through development, but it has not yet been through an independent third-party security audit. It is a genuine work in progress, currently in informal testing with a small group of trusted counsellors, ahead of any wider release.
The security model itself leans on established, industry-standard components: SQLCipher, PBKDF2, AES-GCM, applied carefully to this specific problem. It is not custom, unproven cryptography invented for the occasion. We would rather tell you exactly where this stands than oversell it.
We are testing Safer Haven Therapy Notes with a small group of trusted counsellors ahead of a wider release. If secure, properly built session-note software for your practice is something you have been waiting for, we would like to hear from you.
Talk to us about early access