Security overview

How Verradent protects practice and patient data.

Where data is kept

• Records are stored in a hosted Postgres database. The database provider encrypts it at rest, and all traffic to Verradent uses HTTPS.
• Every query is limited to the signed-in practice. Automated tests check that one practice can't read another's records.
• The hosting provider backs up the database. Verradent also has a full export and restore tool, and a restore test runs on every code change.

Who can get in

• Each staff member has a role (owner, administrator, dentist, hygienist or front desk) that limits what they can see and change.
• Passwords must be at least 12 characters. Repeated failed sign-ins are slowed down, and password reset links work once.
• Staff can add two-factor sign-in with an authenticator app, with one-time recovery codes. It can be required for chosen roles.
• Sessions end after a period of inactivity, and after a fixed maximum length.
• Patients sign in to the portal with a one-time link sent to their email, or a one-time code texted to their phone.

Audit log

Sign-ins, opening a patient's chart, changes to patient records, AI requests and texts sent are written to an audit log with who, what and when. Owners and administrators can review and export it in Settings.

Reporting a vulnerability

Email security@verradent.com with what you found and how to reproduce it.