Can client session notes be edited without a trace?
In most systems, yes. A note edited three weeks after the session looks identical to one written the day of it, because the storage has no memory of its own history, only of its current contents. Tamper-proof only means something if the record's structure makes a silent edit detectable, not if the vendor simply promises it does not happen.
Why this is a real exposure, not a hypothetical
Session notes matter in disputes: a client disputes what was agreed, a referral partner wants to see the record, an audit asks when something was documented. In an ordinary database, an UPDATE statement changes a row and nothing about the row itself shows a previous version ever existed. A practitioner rewriting a note after a disagreement, whether out of good faith cleanup or something less defensible, leaves the same trace as a note that was correct from the start: none.
This is not about assuming bad faith. It is about the record being unable to prove good faith either, which is the actual liability.
What a real answer requires
Append-only
New entries can be added. Existing ones cannot be changed or deleted, enforced at the database itself, not by a policy a person could override.
Dated on write
Every entry is stamped the day it is written, not the day someone later claims it was written.
Independently checkable
A structure a third party can verify without trusting the company that runs it.
How the underlying record does this
VEX reads are built on a record that only appends: the database itself blocks UPDATE and DELETE on entries, so silently rewriting history is not a policy that could be broken, it is not an operation the system can perform. On top of that sits a public transparency log, the same structure defined in the IETF standard RFC 6962, which produces inclusion and consistency proofs: mathematical evidence that a given entry is really in the record, and that the record today is a true continuation of the record yesterday, not a quietly edited replacement. Checkpoints are signed with ES256 and can be verified offline, by anyone, without asking VEX to vouch for itself.
What this is not: a HIPAA or clinical-recordkeeping certification. VEX is coaching and consultancy software and makes no health, therapy, or clinical claim. What it is: a session record whose integrity does not depend on trusting the vendor's word.
How we keep this honest
- Every client is told up front, consents before anything is read, and can withdraw at any time.
- Raw answers stay private. The practitioner sees a rendered read, never the writing itself.
- The transparency log and revocation list are public, not an internal audit trail only VEX can see.
- VEX never scores, ranks, or files a client into a type.
Straight answers
Is this a HIPAA or clinical compliance claim?
What does append-only mean in practice?
What is a transparency log and why does it matter here?
Can I show this to a client or an auditor?
Start every client on a record that cannot be quietly rewritten. The software is free and your first client read is free, no card. Then 39 dollars a read, billed through at your markup.
Read your first client free