01
Practice isolation
Practice-owned records are designed to be scoped by practice ID with row-level security protecting tenant boundaries.
Security by design
Protect the practice without making claims we haven’t earned.
BocaSync is designed around practice isolation, role-based access, private patient files, server-side integration secrets and human approval for sensitive workflows. We won’t market compliance certifications before the required production controls, contracts and verification are complete.
Tenant-awarePractice-scoped access model.Private by defaultPatient files are not public assets.
Core controls
Defense in depth across the practice.
01Practice isolationTenant-scoped records and row-level access controls
02Private storagePatient files use controlled access instead of public URLs
03Server-side secretsCredentials and service keys stay out of the browser
04Human controlSensitive clinical, financial and permission changes require authorized review
Practice-scoped Tenant boundaries matterLeast exposure Secrets stay server-sideHuman-reviewed Sensitive actions aren’t autonomous
Security principles
Designed to protect patient and practice data.
02
Private files
Patient documents use private storage and short-lived signed access rather than public file URLs.
03
Server-side secrets
Service credentials and integration secrets are not intended for browser-managed settings or public marketing code.
Human control
AI assistance does not get a blank check.
Clinical, financial, payroll, security and permission-changing actions remain subject to authorized human review rather than autonomous AI writes.
Security areas
Controls across the full platform.
RLSRole controlsPrivate storageSigned URLsServer-side secretsHuman approval
Questions a dental practice should ask
Clinical and operational security without marketing shortcuts.
04
Account lifecycle
Invites, role changes, deactivation and account recovery should move through explicit authenticated and authorized flows.
05
Auditability
Sensitive actions and administrative changes should retain actor, timestamp and context when the workflow requires it.
06
Incident handling
Confirmed security incidents are investigated, contained and communicated to affected practices as appropriate.
07
Practice data
The practice retains ownership of the data it enters and can request access, correction or deletion where applicable.
08
HIPAA and BAAs
BocaSync does not claim HIPAA compliance or BAA availability until the required controls, contracts and verification are complete and confirmed.
09
Certifications
We do not advertise SOC 2, ISO 27001 or other certifications unless independently verified.
Buyer security checklist
What a dental practice should ask before moving patient data.
Security is more than a vendor logo. Ask how another practice is blocked from your data, how patient files are protected, who can change permissions, what gets logged and how incidents are handled.
07
Encrypted transport
BocaSync application traffic is served over HTTPS/TLS, with managed infrastructure providing encryption controls for stored application data.
08
Auditability
Sensitive administrative, financial and security-relevant actions are recorded where the workflow requires review and accountability.
09
Account lifecycle
Authenticated password-reset, role-management and account-removal flows are used instead of shared staff credentials.
10
Incident handling
Confirmed security issues are investigated, contained and communicated to affected customers as appropriate.
11
Data lifecycle
Access, export and deletion requests are handled according to product capabilities, customer agreements and applicable obligations.
12
Certification transparency
BocaSync does not claim HIPAA, SOC 2, ISO 27001 or another certification unless the applicable product and scope have been independently verified.
Security questions?
Bring them into the BocaSync demo.
We’ll walk through the controls that matter to your organization and clearly separate what is implemented from what is still being certified.