Skip to main content
    dentorb
    Trust · Security & AI Governance

    Patient data is sacred. AI in clinical needs guardrails.

    We treat security and AI governance as table stakes — not as a marketing surface. Here's exactly how patient data is protected and how AI is governed inside dentorb.

    Request DPA / security packView roadmap
    Keep reading
    UK

    Data residency

    Patient data stored in UK / EU regions. No US-only processors.

    AES-256

    Encryption

    Encrypted in transit and at rest. Per-tenant key management.

    Always

    Human in the loop

    Clinical AI proposes. Clinicians decide. Audit trail end-to-end.

    Data protection

    GDPR-aligned by architecture, not by checkbox.

    Lawful basis, purpose limitation, data minimisation and retention rules are built into the data model — not bolted on afterwards. DSARs and erasure requests resolve in days, not weeks.

    • ICO registered, UK GDPR compliant
    • Per-tenant logical isolation
    • Data minimisation in the schema, not just in policy
    • DSAR + right-to-erasure tooling for practice managers

    Encryption & residency

    Encrypted everywhere. Stored in the UK / EU.

    TLS 1.3 in transit. AES-256 at rest. Backup encryption with separate keys. UK / EU regions only — no surprise US data transfers.

    • TLS 1.3 across every endpoint and integration
    • AES-256 at rest with rotating per-tenant keys
    • Backups encrypted and geographically isolated
    • Sub-processor list published and version-controlled

    Access control

    Role-based access, MFA by default, full audit log.

    Clinical, admin, owner and external roles with granular permissions. SSO available, MFA enforced, every privileged action audited and exportable.

    • Role-based access aligned to dental team roles
    • MFA enforced on all accounts; SSO for groups
    • Tamper-evident audit log of every privileged action
    • Session controls: device approval, IP allowlisting (groups)

    Patient identity

    Identity verification at the right moments.

    Verification at booking, before sensitive disclosures, and during AI Phone calls — sized to risk, not to friction.

    • Risk-based verification (DOB + postcode + last visit)
    • Verified WhatsApp Business API for branded comms
    • AI Phone identity checks before any data disclosure
    • Consent ledger per patient, per channel, per purpose

    AI safety in clinical

    AI proposes. Clinicians decide. Always.

    Clinical AI features (treatment plans, notes, photo classification) ship with explicit human-in-the-loop, full citation of source data, and conservative defaults.

    • Human-in-the-loop on every clinical AI surface
    • Citations: every AI answer links back to source
    • Conservative defaults — AI under-promises, surfaces uncertainty
    • AI Safety Council review before any clinical feature ships

    Document & evidence

    DPA, sub-processors, security pack — published, versioned.

    Our Data Processing Agreement, sub-processor list, and security pack are versioned and published. You always know what changed and when.

    • DPA template (review before contract)
    • Sub-processor list with notification on change
    • Security pack: encryption, BC/DR, incident response
    • Penetration test summaries available under NDA

    No autonomous clinical decisions

    Clinical AI is decision-supporting, never decision-making.

    Triage suggestions, treatment plan drafts, photo classification — every clinical AI surface is gated behind a clinician's approval. We will never ship a feature that lets AI act unilaterally on a clinical decision.

    • Hard policy: no autonomous clinical actions, ever
    • Every clinical AI proposal is logged + requires sign-off
    • Suggestions surface uncertainty and source citations
    • AI Safety Council review before any clinical feature ships

    People & process

    Trained team. Tested process. Honest disclosure.

    Engineering trained on healthcare-grade practices. Incident response tested. If something goes wrong, you'll hear it from us first.

    • Engineering trained on UK healthcare data practice
    • BC / DR procedures tested every six months
    • 72-hour breach notification commitment
    • No 'silent fix' policy — material incidents disclosed

    Certifications roadmap

    ISO 27001 and SOC 2 — on a public timeline.

    On the roadmap

    We're pre-seed and we're transparent about where we are. Cyber Essentials Plus is in flight. ISO 27001 is targeted within 18 months of GA. SOC 2 Type II follows. We publish progress every quarter.

    • Cyber Essentials Plus — in progress
    • ISO 27001 — targeted post-GA
    • SOC 2 Type II — to follow
    • Quarterly compliance updates published with the roadmap

    FAQ

    Common questions

    Where is patient data physically stored?+

    UK regions for primary storage, EU regions for redundancy. No US-only processors are used for patient data.

    Do you train AI models on our patient data?+

    No. Patient data is not used to train foundation models. Tenant-specific tuning (e.g. brand voice) is opt-in and isolated to your practice.

    Can we get a DPA before signing?+

    Yes — request via the waitlist form or email. We'll send the DPA, sub-processor list and security pack within 48 hours.

    What about clinical decision support and indemnity?+

    dentorb's AI is decision-supporting, not decision-making. The clinician remains the responsible decision-maker. We document this clearly in our terms.

    Trust

    Want the full security pack and DPA?

    Join the waitlist or request the documents directly. We'll send them within 48 hours.

    Request security packRead AI safety approach