How your clinic's data is kept apart.

One clinic, one database

Most practice-management software is multi-tenant: every clinic's records sit in the same tables, separated by a clinic ID on each row. Isolation then depends on every query being written correctly, forever.

Dentra does not work that way. Each clinic runs as its own deployment: its own application container, its own PostgreSQL database, and its own namespace in file storage. There is no query that could return another clinic's patients, because there is no other clinic in the database to return.

On the Starter and Premium plans clinics may share underlying server hardware, each in its own isolated container and database. Enterprise includes a server that is not shared with another clinic.

Who can see what

Every route in the system is protected by default; access has to be granted deliberately rather than remembered. Roles are assembled from individual permissions, so a receptionist can book appointments and take payments without seeing clinic revenue, and a dentist can chart treatment without seeing payroll.

Permissions are enforced on the server, not by hiding buttons. Hiding a control in the interface is a convenience; the check that matters happens before the data is ever read.

What we record, and what we never record

Changes to patient records, payments and staff accounts are written to an audit log: who did it, what changed, and when. Your clinic can read it. It is not an internal-only trail.

Diagnostic logs are the opposite. They carry identifiers and timings only. Patient names, contact details, treatment notes, payment amounts and query parameters are never written to them. The logging is built so that they cannot be, rather than relying on nobody making a mistake.

Accounts and sign-in

• Passwords are stored hashed with bcrypt, never in readable form.
• Sessions are opaque tokens held in your clinic's own database, rotated in use, not self-contained tokens that stay valid once issued.
• Requests are rate-limited to blunt automated password guessing.
• Signing out ends the session on the server, not only in the browser.

Backups

The database is dumped nightly, compressed, and kept for 14 days. Each dump is size-checked before older ones are removed, so an interrupted or empty backup cannot quietly replace a good one.

Uploaded files are backed up separately from the database. If you are restoring after an incident, ask us to confirm both: records and documents are two stores, and they can drift apart.

Where your data lives

The application and database run on servers we operate. Uploaded documents and X-rays are stored on Cloudflare R2, namespaced per clinic. Email we send on your behalf, such as a demo request from this website, goes through Resend in their Ireland region.

We do not sell clinic or patient data, and we do not use it to train anything.

Who is responsible for what

Your clinic decides what patient information is collected and why; you are its custodian. Dentra provides and operates the software that stores it on your behalf, and acts on your instructions. If you leave, we provide an export of your data and delete what remains.

Reporting something

If you believe you have found a security problem, tell us before telling anyone else and we will work with you on it. The fastest route is WhatsApp.