Security
Last updated: July 14, 2026
A mental health platform holds some of the most sensitive information a person can share. Here's how we protect it — described honestly, without hand-waving.
Every sensitive table on Mentally uses row-level security. That means access rules live in the database itself, not just in the application code: a professional can read their own patients, notes, appointments, and earnings — and nobody else's. Even if a bug slipped into the interface, the database would still refuse to hand over data that isn't yours.
Clinical session notes are the strictest case: they are readable only by the professional who wrote them.
Sign-in, password reset, and session management are handled by Supabase Auth. Passwords are stored as salted hashes — we never see or store the plain text. You can also sign in with Google, in which case we never handle a password at all.
All traffic between your device and Mentally is encrypted with TLS. Data is encrypted at rest by our infrastructure provider.
Card details go directly to our payment processor and never touch our servers. We store only the payment record — amount, status, and which appointment it belongs to.
Public storage holds only what's meant to be public: profile photos and article cover images. Everything else lives behind the same row-level access rules as the rest of your data.
If you discover a security issue, please tell us before telling anyone else — email support@mentally.health with the details. We take reports seriously, we'll respond quickly, and we won't pursue anyone acting in good faith to help us fix a problem.
Use a strong, unique password, don't share your account, and sign out on shared devices. And if anything about your account ever looks wrong, contact us — it's never a bother. For what data we collect in the first place, see our privacy policy.