Security and compliance
Your practice is the HIPAA covered entity. Dentavanta is your business associate. Below is exactly how we protect patient data today, in plain terms, with no claims we cannot back up.
How a request is protected
This is the actual path a request takes today, from sign in to the audit log, not a diagram of something planned.
Layer 01
Every user signs in through a tenant-scoped Cognito user pool. Passwords never touch our own servers, and every request carries a short-lived, signed JSON web token.
Layer 02
Requests hit API Gateway and run through Lambda functions that verify the caller's identity and practice before any data is touched.
Layer 03
The application never opens a direct connection to the database. Connections are pooled and managed through RDS Proxy, reducing the surface for a leaked or exhausted connection to become a problem.
Layer 04
Row-level security policies are enforced by the database itself. A query scoped to one practice cannot return another practice's rows, even if application code had a bug.
Layer 05
Data is encrypted at rest with keys managed through AWS Key Management Service, and encrypted in transit between every service in the chain.
Layer 06
Every access to patient data is written to an audit log a practice can review, so questions about who accessed what have a real answer.
AWS accepted a Business Associate Addendum for our account, covering the infrastructure above. We sign a separate Business Associate Agreement directly with every practice, because your practice is the covered entity and we are your business associate, not the other way around.
Live today
Not yet
Questions we get on every call
There is no official HIPAA certification body, so no software vendor can truthfully claim to be HIPAA certified. What we can tell you exactly: we sign a Business Associate Agreement with every practice, we run on AWS services under an accepted Business Associate Addendum, and every practice's data is isolated with row-level security in the database.
Your practice is the HIPAA covered entity. Dentavanta is your business associate. We sign a Business Associate Agreement with every practice before any patient data is stored, consistent with the AWS Business Associate Addendum already in place at the infrastructure layer.
No. Every table in the database enforces row-level security, so a query scoped to your practice can never return another practice's rows, even if application code had a bug. This is enforced by the database itself, not just by our application.
Not yet. We are early in our build and have not pursued a formal third-party audit like SOC 2 or HITRUST, and we will not claim one we do not have. What is real today is a signed AWS Business Associate Addendum, Cognito-backed authentication, row-level tenant isolation, KMS encryption, and full audit logging, all described above.
Every access to patient data is written to an audit log, so we can trace exactly what happened and when. Our Business Associate Agreement sets out the notification process and timelines we commit to for your practice.
On Amazon Web Services, in the us-east-1 region, on an Aurora Postgres cluster reached through RDS Proxy. There is no direct network path to the database from outside AWS.
Yes. Book a demo and we will walk through the Business Associate Agreement with you directly. It is a real, counsel-reviewed contract negotiated with your practice, not boilerplate we publish on the marketing site.
Talk to an actual engineer
No sales script. You will talk to the person who built the infrastructure above.
Book a demo