Data Security

DenTrackPro is built with security as a foundation, protecting sensitive patient data and clinic records at every level.

Data Isolation

Each clinic operates in its own isolated database schema. No clinic can ever access another clinic's data, even if they share the same server.

Authentication

• JWT-based authentication with token rotation
• Secure HttpOnly cookies prevent token theft via JavaScript
• Login rate limiting (5 attempts per minute) to prevent brute force attacks
• Account lockout support after repeated failed login attempts

Password Security

All passwords are hashed using bcrypt before storage. Plaintext passwords are never stored or logged.

SQL Injection Prevention

All database queries use parameterized statements via Prisma ORM, eliminating SQL injection vulnerabilities.

Payment Security

Online payments are processed by PayMongo with webhook signature verification. DenTrackPro never stores raw card details — all sensitive payment data is handled by PayMongo's PCI-compliant infrastructure.