Security, in plain language.
Teryli supports behavioral-health operations. Before a customer uses it with real organizational data, the exact workspace scope, access model, and data-handling requirements are reviewed in writing.
Start with the boundary. Then verify the controls.
Public preview
Synthetic data only
Product previews use synthetic sample data. No customer record is needed to evaluate the interface.
Public site
No PHI in forms or email
Do not submit protected health information, client details, or resident details through this marketing site, booking page, or email.
Organization access
Scope before activation
Teryli confirms the customer organization, purchaser authority, authorized users, and agreed workspace scope before activation.
Buyer review
Written answers
What’s in place today is listed below. For anything else, send us your questions.
What’s in place today.
- Accounts Everyone signs in with their own account, and access is tied to their organization and role.
- Access logs Sign-ins and data access are logged at the infrastructure level and archived for six years.
- Backups and recovery Point-in-time recovery, deletion protection, and daily and weekly backups are on. In July 2026 we restored a full copy into an isolated database to prove recovery works.
- Real client data Real client information only goes into a workspace after a written agreement and a per-organization approval. Demos and this website use made-up data.
- Hosting This website and our demo sites run on Cloudflare and never receive PHI. Customer workspaces run on Google Cloud.
- BAA If your workspace will hold PHI, we sign a BAA with you before any of it goes in.
- Insurance We carry cyber liability and professional liability (E&O) insurance. Certificate of insurance available on request.
We don’t have a SOC 2 report or other security certification yet. Send us your security questionnaire and we’ll answer it in writing.
We’d rather walk through your questions than gesture at badges.
Teryli is an operational coordination layer, not an EHR and not a clinical decision-maker. The customer remains responsible for defining what information belongs in the workspace and who is authorized to see it.
The public demo uses synthetic, non-real data. This marketing site is not a place to send PHI, client details, or resident details.
We don’t describe Teryli as “HIPAA compliant.” That depends on how a workspace is set up and used. Bring your requirements to a workflow review, or email [email protected], and we’ll answer them against the current product and your agreement.
Filled · in scope · Ruled through · out of scope
Teryli · Security · teryli.com/security
Put the requirements in the agreement.
Before real organizational data is introduced, confirm the data scope, permitted users, authentication and session expectations, retention and deletion terms, support path, incident responsibilities, and whether a BAA or other written term is required.
- Data scopeConfirm in writing
- Permitted usersConfirm in writing
- Authentication and session expectationsConfirm in writing
- Retention and deletionConfirm in writing
- Support pathConfirm in writing
- Incident responsibilitiesConfirm in writing
- BAA or other written termConfirm in writing
- Go-live dateConfirm in writing
Directory records are operational research aids. A source or last-checked date is not an endorsement, availability guarantee, licensure conclusion, accreditation conclusion, or clinical recommendation. Confirm current facts directly with the program.
Found something? Tell us directly.
If you believe you’ve found a security issue involving Teryli, email [email protected] with the details. We take reports seriously and will respond promptly. The same contact is published at /.well-known/security.txt.
Your requirements. A clear conversation.
Review your access, data-handling, and agreement requirements with Christopher. We will identify what needs evidence or written confirmation before live use.