Security Overview

Patient data is stored in UK regions for primary storage and EU regions for redundancy. We do not use US-only processors for patient data.

• TLS 1.3 across every endpoint and integration.
• AES-256 at rest, with rotating per-tenant keys.
• Backups encrypted with separate keys, geographically isolated.

• Role-based access aligned to dental team roles (clinical, admin, owner, external).
• MFA enforced on all accounts; SSO available for groups.
• Tamper-evident audit log of every privileged action.
• Session controls including device approval and IP allowlisting (groups).

• Risk-based verification (e.g. DOB + postcode + last visit).
• Verified WhatsApp Business API for branded comms.
• AI Receptionist identity checks before any data disclosure.
• Per-patient consent ledger by channel and purpose.

• Code review on every change; protected production branches.
• Dependency and vulnerability scanning in CI.
• Secrets management via the platform's vault — never in source control.
• Least-privilege production access; just-in-time elevation.

• Continuous logging of authentication and privileged actions.
• Alerting on anomalous access patterns.
• Documented incident response with on-call rotation.
• 72-hour breach notification commitment to controllers.

• Encrypted, automated backups with point-in-time recovery.
• Restore procedures tested at least every six months.
• RTO / RPO targets published in the customer security pack.

• Background checks for personnel with production access.
• Annual security and UK healthcare-data training.
• Confidentiality and acceptable-use obligations in every contract.

We publish progress quarterly alongside the product roadmap.

• Cyber Essentials Plus — in progress.
• ISO 27001 — targeted post-GA.
• SOC 2 Type II — to follow.

If you believe you've found a security issue, please follow our Responsible Disclosure policy and contact marcus@dentorb.ai.