Back to home

Security

Last updated: May 27, 2026

ClinicPro stores protected health information (PHI) and payment data on behalf of clinics. We take that responsibility seriously. This page summarizes our security posture and our responsible-disclosure policy.

1. Hosting & infrastructure

  • Application and database are hosted on enterprise cloud infrastructure (Vercel / Supabase), both of which maintain SOC 2 Type II compliance.
  • All traffic is encrypted in transit via TLS 1.2+.
  • Database storage is encrypted at rest with AES-256. File storage (consent forms, treatment photos, signatures) is encrypted at rest.
  • Database backups run daily; point-in-time recovery is available for 7 days on Growth and 30 days on Premium.

Data residency

We state this plainly rather than in marketing terms: all ClinicPro clinic and patient data is stored in Canada, in the AWS ca-central-1 region (Montréal). This applies to the database, authentication records, and all file storage (consent PDFs, treatment photos, signatures), regardless of where your clinic is located. Data was held in the AWS us-west-2 region (Oregon, USA) until 2026-09-01.

  • We offer Canadian data residency. We do not currently offer EU, UK, or Australian data residency. If your regulator or contract requires storage in one of those regions, ClinicPro is not a fit today — tell us and we will say so rather than sell around it.
  • Edge routing and caching are handled by Vercel's global network; cached assets are static and contain no patient data.
  • Outbound email is sent from clinicpro.io and SMS via Twilio (USA). AI features send data to Anthropic (USA) — see our DPA for exactly what is sent.
  • Transfers out of the EEA / UK are governed by the Standard Contractual Clauses and the UK IDTA, as set out in the DPA.

2. Access control

  • Every database table that contains clinic data has row-level security (RLS) enforcing tenant isolation by clinic_id. A user can never read or write another clinic's data.
  • Application roles (owner, senior admin, admin, junior admin, manager, provider, front desk) gate write operations via a server-side permission matrix.
  • Authentication is provided by Supabase Auth. Passwords are hashed with bcrypt; sessions use rotating JWTs.

3. Payments

Payment processing runs through two distinct paths. ClinicPro's own subscription billing is handled by Paddle, a PCI DSS Level 1 service provider and our Merchant of Record. Separately, when a clinic connects its own Square account via OAuth, Square processes that clinic's in-clinic card payments, point-of-sale transactions, and membership subscription charges to its clients. In both paths, ClinicPro never receives or stores raw card numbers, CVCs, or full bank details, and webhook payloads are verified cryptographically before any subscription or payment state is mutated.

4. Patient data (PHI)

  • PHI is stored in the same multi-tenant database, isolated by RLS.
  • Audit logs record who viewed or modified clinical records; logs are retained for 7 years.
  • Outbound emails and SMS strip patient identifiers from subject lines and use one-time tokens for portal links.
  • ClinicPro engineers do not access clinic data except when a clinic owner opens a written support request that explicitly authorizes it.

5. Logging & monitoring

  • Application errors are captured via Sentry. PII fields (email, IP address, authorization headers, cookies) are stripped before the event leaves the client.
  • Webhook failures, auth-failure spikes, email/SMS bounce rates, and database errors trigger pager alerts to the on-call engineer.
  • Status of every subsystem is monitored in real time and published on our status page when available.

6. Vulnerability disclosure

If you believe you've found a security vulnerability in ClinicPro, please report it privately to security@clinicpro.io with:

  • A description of the issue and steps to reproduce it.
  • The version, browser, or environment where you observed it.
  • Your name and how you'd like to be credited (optional).

We commit to acknowledging your report within 2 business days, providing a remediation timeline within 7 days, and crediting researchers who follow this policy. Do not perform testing that affects other clinics' data, attempt to access PHI you have no business reason to access, or run automated scanners against production without prior coordination.

7. Compliance roadmap

ClinicPro is operated by Divan Digital Corp (o/a Divan Group). We are working toward SOC 2 Type II attestation in 2026. For questions about compliance and data protection, contact compliance@clinicpro.io.

8. Subprocessors

A current list of subprocessors is published in our DPA at /dpa.

Have questions? Email security@clinicpro.io.