Security & Compliance

• Every record belongs to exactly one organization, enforced at the database level.
• Roles: administrator, BCBA supervisor, trainee, and RBT, each with a different scope.
• Care teams and supervision assignments narrow access to specific students and trainees.
• Internal permission helper functions are not reachable from the public API surface.

Email and password sign-in with leaked-password checking, plus Google sign-in. Sessions time out after a period of inactivity that organization administrators can shorten, and signing out clears cached data in the browser.

Views of student records, edits, signatures, exports, invitations, and consent changes are written to an append-only audit log scoped to your organization. Administrators can search and review it from organization settings. Application users cannot edit or delete audit entries.

Data is encrypted in transit and at rest by the hosting platform, and backups are managed by the platform. Service credentials are stored as managed secrets and are never exposed to the browser.

• Administrators can export their organization's records as CSV or JSON at any time from the privacy and data controls screen. Exports contain only that organization's data.
• Deletion of a single student or of all organization data runs through a request, a typed confirmation, and a cancellation window before anything is removed. Removal is permanent, not a hidden flag.
• Each organization sets a retention window. Student session, note, progress, and classroom records older than that window are removed on a schedule. Financial records and the audit log are retained separately.
• Deletions write a metadata-only entry to the audit log; the deleted content itself is not copied there.

Optional AI features (document import and draft narratives) remove identifiers before text leaves the platform: student names on your roster are replaced with placeholder tokens, and dates of birth, email addresses, phone numbers, and long identifier numbers are stripped. Names are restored on our servers after the result returns. AI output is always presented as a draft for a qualified person to review, edit, and approve — it is never written to a student record automatically.

Administrators can open and track a security incident from inside the product, record its scope and the number of students involved, log when the district and families were notified, and export an investigation packet containing the incident record and the relevant audit trail. Notifications to districts and families are sent by a person; the platform does not send them automatically. Illinois SOPPA notification timelines are a contractual obligation between your district and Accrue — see the Schools & FERPA page.

AccrueABA is designed to support HIPAA-regulated clinical workflows. Accrue Technologies LLC enters into Business Associate Agreements with eligible healthcare organization customers where required.

AccrueABA provides safeguards and contractual support for HIPAA-regulated customers. Each customer remains responsible for its own HIPAA obligations, including its policies, workforce training and access decisions.

Review Business Associate Agreement · Subprocessors

Accrue is designed to operate with minimal protected health information: initials instead of names, optional demographic fields, and an organization-wide minimal-PHI mode. Covered entities that need a business associate agreement can record and download it from the organization settings screen before entering protected health information. Do not enter PHI beyond what your program requires.

Guardian consent is tracked per student and surfaced to staff and administrators. See the children's privacy page for details.

Our current subprocessor list is on the Subprocessors page. School and district customers can review our Schools & FERPA page for how Accrue is designed to operate as a school official once a district designates it under FERPA.

If you believe you have found a vulnerability or a data exposure, stop testing and contact your organization administrator, who can reach our team through the support channel in organization settings. We investigate all reports and will confirm receipt.