Security
Your data is yours. By architecture.
Individual EPI data is structurally isolated. Encrypted in transit and at rest. No stored streaming credentials. Individual data never reaches organizations — not because of a policy, but because of how CHRP® is built.
EPI data is encrypted in transit and at rest
All data transmitted between your device and CHRP® servers is encrypted using TLS. EPI Score™ data and listening behavior stored on our servers is encrypted at rest. Your individual data is inaccessible to organizational administrators by design.
No stored streaming credentials
CHRP® connects to Apple Music and Spotify via OAuth. We never see or store your streaming service username, password, or payment information. You can revoke access at any time through your streaming service account settings.
Individual data never reaches organizations
In organizational deployments, organizations see only anonymous aggregate trends. Individual EPI Score™ data is structurally isolated — this is an architectural property, not a permission setting that can be changed by an administrator.
Minimal data retention
We retain only the data necessary to operate the Service. Listening history is retained on a rolling basis to compute your current EPI Score™. You can request deletion of your account and all associated data at any time.
Our posture
CHRP does not diagnose medical or psychological conditions.
CHRP does not determine fitness for duty or employment suitability.
CHRP does not infer precise emotional states with clinical-grade accuracy.
CHRP is not a substitute for licensed clinical, psychological, or medical evaluation.
Responsible Disclosure
Found a security issue?
We take security seriously and appreciate responsible disclosure. If you have found a vulnerability or security concern, please contact us directly at security@chrp.ai. We will acknowledge receipt within 48 hours and work with you to address the issue.