We run the operating rhythm for your dental offices, which means we handle real performance data. Here's how we look after it.
Every page and database table is scoped by role and by the office or group a person is assigned to. Office managers see their own office; regional managers see the offices assigned to them; admins and the COO see across the group.
Access rules are enforced in the database itself with row-level security, not just hidden in the UI, so a misbehaving client can't reach data it isn't authorized for.
Sign-in uses email-and-password or Google. Sessions are stored in your browser only. We never store passwords ourselves; password checks and resets are handled by our auth provider.
Application data is stored in a managed Postgres database with encryption at rest and in transit. File uploads (such as AR report exports) sit in a private bucket that only authorized managers can read.
We keep backups on the provider's standard schedule. If you need data deleted, contact us and we'll remove it.
Use a strong, unique password and turn on two-factor authentication on your Google account if you sign in with it. Don't share logins between teammates, invite each person individually so we can scope their access correctly.
If you spot something that looks wrong, data showing up where it shouldn't, an account you don't recognize, an email that looks off, tell us right away and we'll investigate the same day.
This page describes the controls we operate today. It is not a third-party audit or certification.