Contents
At a glance
Your website has far fewer ways in than a typical small-business site, it sits behind one of the world’s largest security networks, and it never holds anything about your clients.
- Website software
- No database, admin login or plugins to break into
- Hosting
- Cloudflare’s global network, with attack protection always on
- Connection
- Encrypted on every page, always
- Client information
- Never stored on your website or by Saywell
- Changes
- Every version saved. Any change can be undone
- Your sign-in
- One-time email links. No passwords
- AI
- Never sees client information. Not used to train AI models
- Payments
- Bank transfer only. We never ask for card numbers
- Forms
- Spam-checked, and only accepted from your own website
1How your website is built
- Your pages are built ahead of time into plain, finished files. There is no database, no admin login and no plugins, so the most common ways small-business websites get broken into simply don’t exist on yours.
- There’s nothing on your side to update or patch. The code is standard and portable, and 100% yours after 12 months.
2How it’s protected
- Cloudflare’s network stands in front of your website. It filters out attacks and bad bots before they reach your pages, and serves your site from hundreds of cities, so one location having a problem doesn’t take you offline.
- Every page is encrypted. Visitors always connect over HTTPS, and browsers are told to never use an unencrypted connection to your site.
- Browser safeguards are switched on, so other websites can’t embed your pages to trick visitors, browsers don’t guess at file types, and your pages can’t ask for a visitor’s camera, microphone or location.
- Forms are guarded by a spam check and only accept submissions sent from your own website.
3Your clients’ information
- Your website never holds information about your clients, and neither does Saywell. We don’t ask for it, and we never need it.
- Intake and contact forms that collect client details run through a HIPAA-compliant provider that signs a business associate agreement with you. Submissions go to you, not to us.
- Please keep client details out of your change requests. Archie and our team never need them.
4Changes, backups and recovery
- Every published version of your website is saved. Any change can be rolled back to an earlier version, by you from the portal or by our team.
- Nothing goes live without your approval, and every change goes through automatic checks first, such as making sure the site builds without errors.
5AI, used safely
- AI helps research, draft and prepare changes. Our team reviews its work, and you approve anything clinical before it’s published.
- Your clients’ information never goes into our AI tools: no client names, session details or protected health information (PHI) ever goes into Archie or Claude, or to Anthropic. Archie, our AI assistant, runs on Claude and works only with your public website. The AI services we use work under business terms that don’t allow our content to be used to train their models.
6Accounts and access
- You sign in to your Clients Portal with a one-time link sent to your email, so there’s no password to steal or reuse.
- Our team uses two-factor sign-in and a password manager on every account, and only the people who need access have it.
- Partners who referred you never see your portal, your requests or anything about your clients.
7Payments
- You pay by bank transfer using the details on your invoice. We never ask for card numbers by email or phone.
- We will never change our payment details without telling you in writing first. If an email asks you to pay a different account, don’t pay it: reply to us or email hello@hellosaywell.com to check.
8If something goes wrong
- Our engineers, developers and automated checks watch your website around the clock, so most problems are fixed before you’d notice.
- You can check our live status any time at status.hellosaywell.com, which shows whether your website and forms are up, right now.
- If an incident ever affects your website or your information, we tell you promptly, explain what happened and what we did about it, and notify the National Privacy Commission when the Data Privacy Act requires it.
Report a security concern
If you notice anything that looks wrong, or you’re a researcher who has found a problem, tell us. A person on our team replies within 1 business day.
| hello@hellosaywell.com | |
| Live status | status.hellosaywell.com |
| Privacy | Our Privacy Policy explains what we collect and your rights |