Platform & security

The engine, the API, and the paperwork.

For the IT lead, the security reviewer, and the engineer who has to integrate it. A versioned multi-tenant API, a pluggable flow runtime, and an AI Computer Use layer that reaches any EMR in days.

Book a demo → See the API →
Engine signal
Shipped, not roadmap
1,109
Clients served across deployed flows.
15+
Therapeutic flows running in production.
200K+
Structured clinical data points captured.
Day 1
HIPAA / GDPR / 42 CFR Part 2.
What only Cuepri ships

The three things no competitor has.

These aren't features layered on top. They're architectural decisions baked into the engine.

Unlock 01

Pluggable Flow Architecture.

Every conversational journey is a `FlowHandler` class against a shared contract. Your treatment programs, coaching curricula, meditations, homework, custom check-ins deploy as flows on the same runtime. Add a new flow in days, not quarters.

Unlock 02

Continuations.

The AI proactively schedules and fires structured follow-ups tied to in-session commitments. Reactive between-session AI is table stakes; proactive is the unlock.

Unlock 03

AI Computer Use Integration.

Connect to any EMR in days. AI agents navigate the EMR's UI programmatically. No custom APIs, no vendor cooperation, no integration tax.

The integration surface

An API, an SDK, and a runtime. White-label by default.

Versioned REST, multi-tenant by design, lean responses with on-demand expansion, async-first, webhook and SSE event delivery. No Cuepri branding in any response.

Selected endpoints GET /v1/facilities/{facilityId}/clients ?include=weeklySchedule,events,risk &filter[tags]=anxiety &page=1&pageSize=50 POST /v1/facilities/{facilityId}/ehr-notes → 202 Accepted { jobId, statusUrl } GET /v1/facilities/{facilityId}/events/stream (Server-Sent Events) POST /v1/webhooks/subscriptions { events: ["sihi.detected","checkin.completed"], endpoint: "https://partner.com/cuepri", secret: "***" } GET /v1/facilities/{facilityId}/important-events ?period=2026-04-01-2026-04-30 &filter[type]=sihi
Versioned & multi-tenant
/v1/ prefix, all data scoped by facilityId. Database-agnostic API contract.
Lean by default, expand on demand
?include= parameter for optional enrichments. No over-fetching.
Async-first
200 for fast operations, 202 with job reference for long-running ones.
Real-time events
Server-Sent Events for browser clients. Webhooks (HMAC-SHA256, retries) for server-to-server.
White-label by default
No Cuepri branding in API responses. Clients see your brand. Clinicians see your workflow.
Three integration paths

Three paths in. None require your engineers to wait.

Pick the one that matches your stack and your timeline.

Days

AI Computer Use

Our agents drive your existing EMR UI programmatically. No custom API on the partner side, no vendor cooperation, bidirectional reads and writes.

When there's no API, the API is locked, or you won't wait for a vendor to build one.
Weeks

REST API + Webhooks

Versioned, multi-tenant, white-label. Webhook subscriptions for real-time events, SDK helpers for common languages.

When you have your own data model and want Cuepri behind your existing surfaces.
Custom

Embedded runtime

The full flow runtime inside your stack. Your treatment programs deploy as flows on the same engine, co-engineered with our team.

When you're building a clinical product and want Cuepri as the foundation, not a bolt-on.
Security & compliance

Compliance-ready Day 1. Not a roadmap item.

Behavioral health is regulated more heavily than general healthcare. 42 CFR Part 2-aware data handling and GDPR-compliant deletion flows, built in.

HIPAAReady Day 1
GDPRCompliant
42 CFR Part 2Aware
Mandatory MFA

TOTP (RFC 6238) primary, SMS OTP backup, 5 hashed recovery codes. Required for all staff accounts.

Multi-tenant isolation

All data scoped by facilityId. No cross-tenant leakage paths. Verified at the API layer on every request.

Granular RBAC

Roles plus permissions stored separately. Cached ~5 min, server-enforced on every request.

Device trust + session TTL

Trusted devices skip MFA for 30 days, admin-revocable. 12-hour session hard limit.

Multi-layer rate limiting

Per-IP limits on auth, registration, session, and data endpoints.

Encryption + audit

Encryption at rest (Firestore, BigQuery) and in transit (TLS 1.2+). Full audit log of dashboard access.

Inspect what you'd embed

Inspect what you'd embed.

We'll walk through architecture, security posture, and integration model in detail. Your timeline, your evaluators.

Book a demo →
HIPAAReady Day 1
42 CFR · Part 2Compliant
Deploys inDays, not quarters