> ## Documentation Index > Fetch the complete documentation index at: https://docs.getrivet.ca/llms.txt > Use this file to discover all available pages before exploring further. # Privacy & security > How Rivet handles your clients' information, what's encrypted, what's stored where, and what you control as the custodian of your records. You're a regulated practitioner. The people who call your line are reaching out about their mental health. Everything about how Rivet handles that information matters — to your College, to your clients, and to you when an audit lands on your desk. Rivet is designed to be consistent with Canada's *Personal Information Protection and Electronic Documents Act* (PIPEDA) and Ontario's *Personal Health Information Protection Act* (PHIPA). Rivet acts as your **agent** under PHIPA s.2 — handling client information on your behalf, under your direction. ## Your role and Rivet's role The legal characterization. Rivet as agent + electronic-service provider. Where each piece of law fits. What being a health information custodian means in practice — and what Rivet does on your behalf. The agreement you accept when you sign up. What it covers, who the sub-processors are, what changes when you cancel. What Rivet stores about your clients, retention defaults, and your client's right to deletion. Voicemail audio and transcription run on Canadian hardware. The specific path each voicemail takes from caller to inbox. The College-auditor answer. Specific table of every kind of information and where it physically lives, plus the evidence Rivet can produce on request. ## Safeguards and incident response HTTPS everywhere, AES-256 at rest, biometric-locked sessions, WebRTC DTLS-SRTP for video. The append-only log that records who touched what, and why metadata is all that goes in it. The five phases. Who Rivet notifies. How Rivet helps you meet your own notification obligations. The line between what Rivet captures and what belongs in your EHR — and why that line is the whole point. The handful of habits that keep your account, your sign-in email, and your device honest.