Security First

Security Center

Your patients trust you with their health data. We take that responsibility seriously. Here's how Dentara protects your practice.

🏗️Infrastructure Security

HTTPS/TLS Everywhere

All connections are encrypted with TLS 1.2+. HTTP requests are automatically redirected to HTTPS. Certificates are auto-renewed via Let's Encrypt.

Encrypted Database

PostgreSQL with connection-level encryption. All queries use parameterized statements to prevent SQL injection.

Hardened Server

SSH key-only authentication (no passwords), UFW firewall with minimal open ports, fail2ban for brute-force protection.

Automatic Updates

Unattended security updates enabled. Server packages and dependencies are regularly patched.

🛡️Application Security

Role-Based Access Control

Granular permissions: Admin, Dentist, Receptionist, Staff. Each role sees only what they need. Audit trails for all actions.

Secure Sessions

HTTP-only, secure cookies. Automatic session expiry. No sensitive data stored client-side.

CSRF Protection

All state-changing requests are protected against cross-site request forgery attacks.

Input Validation

Every input is validated with Zod schemas on both client and server. No unvalidated data reaches the database.

SQL Injection Prevention

Drizzle ORM with parameterized queries as the default. Any raw SQL usage is limited and carefully reviewed to prevent injection.

XSS Prevention

React's built-in escaping, Content Security Policy headers, and sanitized user inputs prevent cross-site scripting attacks.

🔐Data Protection

Tenant Isolation

Each clinic's data is logically isolated. Cross-tenant access is architecturally impossible.

bcrypt Passwords

All passwords are hashed with bcrypt (cost factor 12). We never store or log plaintext passwords.

Session Security

Sessions expire after inactivity. Sensitive operations require re-authentication.

Audit Logging

Every significant action is logged: logins, record changes, exports, permission changes — with timestamp and user.

Consent Management

Patient consent forms are tracked digitally. Clinics can manage consent records per patient.

Secure Communications

WhatsApp messages sent via end-to-end encrypted protocol. No patient data in error reports.

📋Compliance

DPDPA 2023

Compliant with India's Digital Personal Data Protection Act. Consent-based processing, data principal rights, breach notification within 72 hours.

HIPAA-Aware

While not yet HIPAA certified, our security controls align with HIPAA requirements. Formal certification is on our roadmap.

GST Record Retention

Billing records retained for 8 years per GST Act requirements. Medical records retained minimum 3 years per Indian Medical Council.

Consent Management

Digital consent tracking, purpose limitation, data minimization, and the right to withdraw consent at any time.

📊Security Controls Tracker

12 of 19 controls implemented63%

Implemented (12)

HTTPS/TLS EncryptionRole-Based Access Control (RBAC)Audit Loggingbcrypt Password HashingZod Input ValidationSQL Injection PreventionXSS PreventionCSRF ProtectionTenant Data IsolationSecure Session ManagementPatient Consent FormsWhatsApp Automation Security

🔄In Progress (3)

Two-Factor Authentication (2FA)IP AllowlistingAES-256 Encryption at Rest

📋Planned (4)

SOC 2 Type II CertificationHIPAA CertificationPenetration Testing ProgramData Loss Prevention (DLP)

🗄️Data Retention

Data TypeRetention PeriodRegulation
Patient / Medical RecordsMinimum 3 yearsIndian Medical Council
Billing & GST Records8 yearsGST Act / Income Tax Act
Audit Logs2 yearsSecurity Best Practice
Session Data30 daysOperational
Appointment Reminders90 daysOperational
Account DataUntil deletionConsent / DPDPA

🔍 Responsible Disclosure

We welcome responsible security researchers. If you discover a vulnerability in Dentara, please report it to us privately. Do not publicly disclose the issue until we have had a chance to address it.

security@dentara.health

We aim to acknowledge reports within 48 hours and resolve critical issues within 7 days.