Data Security

1. Tenant Isolation

Every clinic's data is isolated at the database and API layer. Every request is checked against the authenticated user's clinic — there is no path for one clinic to access another clinic's patients, reviews, or team data, even by guessing a URL or record ID.

2. Access Control

Access to a clinic's data is governed by granular, per-user permissions, not an all-or-nothing login.

• Role-based access (owner, admin, manager, staff, viewer, billing-only)
• Individually toggleable permissions — reply approval, billing access, team management, and more — set per team member
• Full activity logging: every reply posted, review request sent, platform connected, role changed, and login is recorded with who did it and when

3. Authentication

Passwords are hashed with bcrypt and never stored or logged in plain text. Sessions use short-lived signed access tokens with automatic refresh, rate-limited login attempts, and account lockout after repeated failed logins.

4. Backup & Recovery

Data is regularly backed up to prevent loss and ensure business continuity.

• Automated backups
• Disaster recovery planning
• High availability systems

5. Continuous Improvement

We continuously monitor, test, and improve our security practices to stay aligned with evolving industry standards and emerging threats.