Where your records live
You hold children's records, therapy notes and safeguarding concerns. Here's how Journify looks after them, in plain English.
Everything stays in the UK
The database and its backups, uploaded files, logs, the emails and texts we send for you, and the AI that drafts notes all run in UK data centres.
Card payments run through your own Stripe account, and Xero or QuickBooks sync through yours, so their terms apply. Card numbers never reach Journify.
- Hosting, database, backups and files
- Amazon Web Services, London
- Email we send for you
- Amazon SES, London
- Text messages
- FireText, UK
- AI note drafting
- Amazon Bedrock, London
- Speech to text for the AI scribe
- Amazon Transcribe, London
Who can see your records
Nobody at Journify, by default. Our team has no standing access to practice data.
- Support only looks when you approve it from your settings, read-only for two hours unless you say otherwise
- Clinical records stay out of a support session unless you include them
- Every page our team views goes into a log you can read
- Emergency access needs two people to approve it, and we tell you afterwards
How signing in works
Your team
A password and a second step: a passkey or an authenticator app. Owners and practice managers use passkeys. No practice can turn the second step off.
Parents and clients
A six-digit code sent by email, or a link that only works in the browser that asked for it. Codes expire after 10 minutes, and there's no password to reuse.
Larger practices
On the Clinic plan your team can sign in with Microsoft 365 or Google Workspace.
Each practice kept apart
Every practice's records are locked to that practice in the database, encrypted with its own key and stored in its own area.
Before every release, an automated test tries to read one practice's records from another. If it gets anything back, the release stops.
Certificates
We'll only show a certificate once Journify holds it in its own name. This is the plan.
- Cyber Essentials Plus
- Planned before launch
- DCB0129 clinical safety case
- In progress
- NHS Data Security and Protection Toolkit
- Before our first NHS-commissioned customer
- ISO/IEC 27001
- Within 12 months of launch
Questions from your DPO?
Our data processing agreement and full list of sub-processors are available on request. Ask anything and we'll answer in writing.