Security

What we hold

Business records about dental practices compiled from public sources and licensed data, account details for members and owners, and what people send us through forms. We hold no patient information and do not seek it. What we collect is listed in the privacy notice.

Hosting and encryption

• The site and its application code run on Cloudflare's network. Application data is kept in a managed Postgres database.
• The site is served only over HTTPS, with HTTP Strict Transport Security; plain HTTP requests are redirected.
• Connections between the application and its database are encrypted, and data is encrypted at rest.
• Pages are sent with a content security policy, and other sites may not frame them, except the chart embeds made to be embedded.

Access

• Staff sign in with passkeys, and every staff action in the console is written to an audit log.
• Members' searches and exports are logged.
• Secrets are held in the hosting provider's secret store, never in source code.

Reporting a vulnerability

If you believe you have found a security vulnerability in DDSIntel, email security@ddsintel.com with the steps to reproduce it. Please:

• Give us a reasonable time to fix the issue before you disclose it.
• Do not access, change or delete data that is not yours, and stop as soon as you have shown the issue.
• Do not run denial-of-service tests, social engineering or physical attacks.

We will acknowledge your report, keep you informed while we fix it, and not pursue legal action for research done in good faith within these rules. Our contact details are also published in security.txt.