Therapists are not security engineers. They don’t need to be. What they do need is a clear-enough mental model of what “cloud” and “secure” mean for their client data, so they can make good vendor choices and answer client questions confidently.
This post is that mental model. No jargon you don’t need, and the specific things that actually matter.
What “cloud” means in practice
Your practice-management tool runs somewhere. That somewhere is a data centre — a building full of computers, managed by Amazon (AWS), Google (GCP), Microsoft (Azure), DigitalOcean, or smaller providers.
Your data lives in that building, on disks. When you open the tool, your laptop talks to that building over the internet, gets data, shows it to you.
That’s it. There’s nothing mystical about cloud. It’s other people’s computers, accessed over the internet.
The four risks worth understanding
Risk 1: data in transit. Between your laptop and the data centre, the data travels over wires. Without protection, anyone in the middle (your ISP, a hostile network) could read it.
The protection: HTTPS / TLS encryption. Every modern website has
this. If your practice-management tool’s URL starts with https://,
the data in transit is encrypted. This is non-negotiable; treat any
tool without HTTPS as broken.
Risk 2: data at rest. Once data arrives at the data centre and gets written to a disk, that disk could be physically stolen, or accessed by an unauthorised person, or backed up to an insecure location.
The protection: encryption at rest. The data on the disk is stored in scrambled form; without the key, it’s gibberish. Modern tools encrypt at rest by default. AES-256 is the standard term to listen for.
Risk 3: account compromise. Someone gets your password (you re-used it, or you got phished). They log in as you and read everything.
The protection: a strong unique password, plus two-factor authentication (2FA). 2FA means even if your password is stolen, they can’t get in without your phone. This is the single biggest security upgrade you can make in 60 seconds.
Risk 4: vendor compromise. The company running your tool itself gets hacked. Data is stolen at the source.
The protection: limited from your side. You depend on the vendor’s security practices. Indirect protection: pick vendors who take security seriously (visible in their documentation, willingness to answer security questions, public security posture).
What “AES-256” and “TLS 1.2” actually mean
If you’ve heard these terms and felt confused, the short version:
TLS (Transport Layer Security). The protocol that encrypts data in transit. TLS 1.2 is the modern minimum; TLS 1.3 is even better. You don’t need to choose; any modern tool uses one of these.
AES-256. A specific encryption algorithm used to encrypt data at rest. The “256” refers to the key length; longer keys are harder to break. AES-256 is the modern standard for sensitive data.
When a vendor says “AES-256 encryption at rest, TLS 1.2+ in transit,” they’re saying both your data-at-rest and data-in-transit protections are in place. This is the floor.
Vendor questions worth asking
Five specific questions for any practice-management vendor:
- Where is my client data physically stored?
- Is it encrypted at rest? With what?
- Is data in transit encrypted? With what?
- Do you offer two-factor authentication?
- What’s your security incident notification policy?
A vendor who can answer all five clearly is probably safe. A vendor who hedges or sends you to vague documentation is probably not worth the risk.
The DPDP Act 2023 angle
India’s Digital Personal Data Protection Act 2023 sets up a framework for personal data handling. Specific implications for practice-management tools:
- Lawful purpose for processing (you have one — providing therapy)
- Consent from the data principal (your client)
- Reasonable security safeguards (the encryption above)
- Breach notification (if there’s a breach, your client should know)
- Data subject rights (right to access, correction, erasure)
Most decent practice-management tools are quietly DPDP-aligned. Some are not. The DPDP rules are still being finalised in 2026, but the principles are clear.
A specific question: India vs international hosting
Should you prefer a tool that stores data in India?
The case for India hosting:
- DPDP Act compliance is simpler
- Faster access (lower latency)
- Less jurisdictional ambiguity
The case for international hosting (AWS US, GCP EU, etc.):
- Sometimes more mature security practices
- Better resilience
- Larger vendor base
In 2026, neither is decisively better. India-hosted is becoming the default for tools built for the Indian market (including ours). International hosting is fine if the vendor has clear documentation and a DPA available.
What MindMaster does
Disclosure (we make it):
- Data hosted in India
- AES-256 at rest, TLS 1.2+ in transit
- 2FA available, recommended on enable
- Daily encrypted backups
- Security incident notification within 48 hours
- DPA available on request
You can audit us against the questions above. We’ve also published specific security documentation; ask via contact@modoware.com for the current version.
A specific note on AI tools
A 2026 question worth flagging. AI transcription, summarisation, and note-assistance tools have specific confidentiality implications:
- The audio or text gets sent to a third-party AI service
- The AI service may store or use the data for training
- Most AI services are not in India
- The data crosses jurisdictions
Before using any AI tool with client data, confirm:
- The vendor’s data retention policy
- Whether your data is used for training
- Where the data is processed
- Whether there’s a data-processing agreement
Many AI vendors don’t have clear answers in 2026. The pragmatic posture: avoid AI tools that process clinical content until their practices are clearer, or use them only with explicit client consent and a DPA.
A close
Cloud security for therapy practice is a smaller problem than it sounds. Four risks. Standard protections. Five questions to ask any vendor. Two-factor authentication on your account.
Most modern tools handle this well. The ones that don’t are mostly identifiable by a single conversation. The 30 minutes you spend asking these questions before signing up saves you from years of worry afterwards.
Ours: mindmaster.modoware.com. For the broader topic, the National Cyber Security Coordinator and the MeitY guidelines on personal data are good background reading if you want to go deeper.