Security
Your practice is the HIPAA covered entity, and DENTAVANTA acts as your business associate. This page describes only the controls implemented today, in plain terms, and says plainly which ones are still planned.
How a request is protected
From sign-in to the audit log. Each layer below is in place now, not a diagram of something planned.
Layer 01
Practice users sign in through a Cognito user pool. Passwords are never handled by our own servers, and every signed-in platform request carries a short-lived, signed token that is verified before the request runs.
Layer 02
Requests pass through API Gateway to Lambda functions that confirm who the caller is and which practice they belong to before any data is read or written.
Layer 03
The database sits in a private network with no direct route from the internet. Administrative access goes through a logged AWS Systems Manager session, not an open port.
Layer 04
Row-level security policies are enforced by the database itself. A query scoped to one practice cannot return another practice's rows, even if application code had a bug.
Layer 05
Data is encrypted at rest with keys managed in AWS Key Management Service. Connections between the application and the database use TLS.
Layer 06
Platform actions on practice data are written to an audit log that the database prevents from being edited or deleted, so questions about who did what have a real answer.
AWS has accepted a Business Associate Addendum for our account, covering the infrastructure above. A Business Associate Agreement between your practice and DENTAVANTA is required before any patient data is processed, and we will walk through its terms with you before onboarding.
Live today
Not yet
There is no official HIPAA certification body, so no software vendor can truthfully claim to be HIPAA certified. What we can describe exactly is on this page: the technical safeguards in place today, the AWS Business Associate Addendum on our account, and the Business Associate Agreement we require before any patient data is processed.
Your practice is the HIPAA covered entity. DENTAVANTA acts as your business associate. A Business Associate Agreement between us is required before any patient data is processed.
Practices share the same database, but row-level security policies enforced by the database itself mean a query scoped to your practice cannot return another practice's rows, even if application code had a bug.
Not yet. We are pre-launch and have not pursued a formal third-party audit like SOC 2 or HITRUST, and we will not claim one we do not have.
Report it to hello@getdentavanta.com. The audit log lets us trace what happened and when, and your Business Associate Agreement sets out how and when we notify your practice.
On Amazon Web Services in the us-east-1 region, in an Aurora Postgres database with no direct network path from the internet. AWS is our hosting subprocessor; we will publish the full subprocessor list, including messaging and telephony vendors, once those agreements are approved and before patient data flows through them.
Security is shared. Your practice decides who gets an account, keeps sign-ins private (one account per person), confirms patient messaging consent, and approves every template. DENTAVANTA runs authentication, tenant isolation, encryption, and audit logging, keeps patient data out of URLs, analytics, and marketing tools, and uses synthetic data for demos and testing. AWS secures the underlying data centers and cloud services.
Patient contact details and message content needed for the growth workflows, plus activity records for reporting. DENTAVANTA does not hold clinical records or billing data. Every user has a unique account scoped to one practice, and retention and deletion terms are set out in your Business Associate Agreement.
Yes. Book a demo and we will walk through the Business Associate Agreement with you before any onboarding begins.
Talk to the engineer
No sales script. You will talk to the person who built the infrastructure above.
Book a Demo