Toothvity · India
Security
Last updated: June 2026. A plain-language overview for clinic owners. This page describes our security practices — it is not a certification or compliance attestation.
Dental clinics handle sensitive patient information. Toothvity is designed so your team can work efficiently while keeping access controlled and records dependable.
Plan tiers and access
Starter covers core workflows — patients, appointments, prescriptions, and invoices — with an owner login. Growth and above add treatment plans, consent forms, the recall engine, team invites and roles, and full practice analytics. Multi-location onboarding is sales-assisted today; advanced branch workspace tools are on the roadmap. See our Pricing page for the current comparison.
Encrypted transport (HTTPS)
Browser and API traffic to Toothvity uses TLS (HTTPS). Do not disable certificate warnings on clinic devices.
Role-based access control
Starter includes a secure owner login. On Growth and above, owners invite staff with dentist, receptionist, admin, and owner roles. Permission checks run on server actions and APIs.
Tenant isolation
Each clinic workspace is scoped by clinic_id. Row-level security and server-side tenant resolution prevent cross-clinic data access.
Verified email enforcement
Users must verify email before creating a clinic or using product routes. Unverified sessions are redirected or blocked at the proxy layer.
Audit logging
Team invite, billing management, and knowledge-base actions append rows to audit_events. Security risk events (login failures, rate limits, access blocks) are logged for owner review.
Rate limiting and abuse controls
Auth and invite flows apply rate limits to reduce credential stuffing and spam. Disposable email domains are blocked at signup. Platform operators monitor abuse signals in an internal console.
Billing protections
Subscription changes use row locks, idempotency keys, and webhook-only status updates so payment state cannot be forged from the client.
Soft delete and recovery
Patients, documents, and related records support soft delete (is_deleted) so authorised staff can recover mistaken removals where the product allows.
Storage reconciliation
Platform operators can run storage reconciliation jobs to detect orphaned objects in clinic branding and support-attachment buckets and align usage counters with actual storage.
Operational backups and export readiness
Hosted infrastructure includes database backup capabilities. Storage objects (branding files and support attachments) can be exported manually by platform operators for disaster-recovery drills — there is no automated cross-region DR or clinic self-service restore UI today.
File storage
Toothvity stores clinic branding files (logo, banner, signature) and support ticket attachments in private cloud storage. Clinical PDFs (prescriptions, invoices, consents, treatment plans) are generated on demand from your database records and are not kept as permanent upload objects.
- Per-plan storage quotas apply to branding and support attachments separately. Uploads are blocked before they exceed your allowance.
- Per-file limits: logo and banner 2 MB each, signature 1 MB, support attachments 5 MB (up to 3 per message).
- Replacing a logo, banner, or signature removes the previous image from storage. Deleted or replaced files may persist in operational backups for a limited window per our Data Retention policy.
What we do not claim
Toothvity is not certified under HIPAA, ISO 27001, or SOC 2 at this time. We do not publish specific encryption-at-rest attestations beyond what our cloud providers document. We do not offer automated disaster recovery or a clinic-facing restore UI for individual edits. If your practice requires formal compliance programmes, evaluate Toothvity alongside your legal and IT advisors and implement clinic-side controls (staff training, device policies, patient notices).
What your clinic should do
- Use individual logins for each staff member (Growth+ when inviting team)
- Remove or deactivate access promptly when someone leaves
- Keep front-desk devices patched and screen-locked
- Retain copies of records you are legally required to keep outside the app
- Report suspected misuse immediately
Report a security incident
Email security@toothvity.com with steps to reproduce, affected accounts, and timestamps. For privacy questions see support@toothvity.com or our Privacy Policy. Owners can review clinic-scoped risk events at Security events (owner role, signed in).