Enterprise-grade protection for your patient data

Data we handle

Protected Health Information (PHI). DentLedger handles the patient identifiers and insurance data your practice submits for verification: patient names and dates of birth, insurance member and group IDs, plan records, eligibility responses, and the full verification history for each patient. We process this PHI solely for the purpose of insurance verification and billing operations — we do not sell, share, or use it for marketing, research, or any purpose unrelated to the services we provide to your practice.

Accounts-Receivable data. Beyond PHI, DentLedger handles the billing data that lets your office collect what it's owed: claim amounts, allowed amounts, deductibles, payments, write-offs, denial reasons, and any office-defined follow-up notes you attach to a claim. This AR data is unique to DentLedger versus a generic HIS — it is what lets us flag underpaid claims and predict denials, and it is treated with the same security controls as PHI.

Encryption

Patient data is encrypted at every stage — at rest in our database and in transit between your practice and DentLedger:

• Encryption at rest: All stored data — PHI and Accounts-Receivable records alike — is encrypted using AES-256, managed by our database provider (Neon). This is the same standard used by healthcare institutions and government agencies worldwide.
• Encryption in transit: All data moving between your practice and DentLedger is protected by TLS 1.2 or higher. This applies to every API call, dashboard load, and file upload.

Per-Office Data Isolation

Each dental office's data is logically separated from all other offices. DentLedger implements strict tenant isolation at the database level — your patient records, verification history, and billing data are never accessible to any other practice.

This isolation is enforced at the infrastructure level, not just through application-level permissions. Even in the event of a system-level incident, cross-tenant data access is architecturally prevented.

• Logical database isolation per office account
• No shared data stores between tenants
• Strict API enforcement at every endpoint

Trust Architecture

Every byte of patient data passes through the same hardened stack. Here is what protects it, top to bottom.

• 1. Your browser → DentLedger (TLS 1.2+): all dashboard traffic is encrypted in transit; HSTS preload is enabled; no plaintext endpoints are ever served.
• 2. DentLedger → AI engine (authenticated, scoped): every verification call carries an office-scoped JWT; no shared keys, no cross-tenant reads.
• 3. AI engine → Neon PostgreSQL (AES-256, isolated): all PHI and AR data lives behind AES-256 encryption at rest, managed by Neon.
• 4. Backups & retention: encrypted backups with ≥ 6-year retention per HIPAA §164.316(b)(2); append-only audit log retained on the same schedule.
• 5. Access: least-privilege IAM; no shared logins; MFA available for admin accounts; sessions terminable by the account owner.

Access Controls

DentLedger enforces the principle of least privilege: every user and system component has access only to the data and operations required for its role.

• Owner-only API keys: each office account is issued its own JWT/key for the AI verification engine. There is no shared service account, no super-user, and no worker that can read across offices.
• Per-office authentication: every dashboard login is scoped to a single office_id; cross-tenant access is rejected at the route layer.
• No shared logins: seat-based admin accounts only — no group logins, no vendor backdoor.
• Audit logging: All access to PHI is logged with timestamps, user identity, and action performed. Logs are retained for a minimum of 6 years in accordance with HIPAA requirements.
• Session management: Authenticated sessions expire after periods of inactivity. All sessions can be terminated remotely by the account administrator.
• Multi-factor authentication: Supported for all administrator accounts.

Audit Trail

Every claim action — create, edit, verify, export, delete — and every access to PHI is recorded in an append-only audit log with timestamp, actor, and office_id. Audit records are retained for a minimum of six years in accordance with HIPAA §164.316(b)(2), and are available to your practice and to a contracted compliance officer on request.

• Per-action logs for create / edit / verify / export / delete on every claim
• Per-access logs for every read or write to PHI, scoped by office_id
• ≥ 6-year retention per HIPAA §164.316(b)(2)

Rate Limiting & Abuse Protection

Every DentLedger API endpoint enforces a per-IP rate limit so that automated scrapers, runaway integrations, and credential-stuffing attempts cannot exhaust capacity or exfiltrate records. Limits are applied at the application layer and rejected requests return HTTP 429.

• Global API limit: every /api/* route is capped at 120 requests/minute per source IP.
• Pilot signup limit: the pilot signup endpoint is additionally capped at 3 requests/hour per source IP, preventing mass signups.
• Rejection: excess requests return HTTP 429 with a JSON error body and the client is expected to back off.