The risk usually isn't you
Most leaks don't start on a therapist's laptop. They start at a company that holds the data. In October 2026, a Medi-Cal billing contractor disclosed that information on 970,403 people had been accessed, and the letters went out eleven months after the intrusion.
You had no say in how that contractor ran its systems, and neither did the people affected.
Count the companies
Every online tool that touches a session adds a company that could be breached: the app itself, the hosting platform it runs on, and the AI service that writes the draft. That same month, a cloud platform hosting more than 16 million app services disclosed that an attacker may have obtained some customers' decrypted secrets.
Fewer companies means fewer places for a leak to happen.
Three habits that cover most of it
- Use a long passphrase on your computer and turn on its disk encryption.
- Keep your operating system updated; updates fix the flaws attackers use.
- Prefer tools that keep session content on your own device.
Where Astralcyte Notes fits
Astralcyte Notes records, transcribes and drafts your note on your own computer. The temporary audio is deleted once the transcript is saved, and everything sits in an encrypted vault. Nothing is sent to a cloud AI service.