Security & responsible disclosure

Our controls

• AES-256 encryption at rest, TLS 1.3 in transit, hardware-backed key management with scheduled rotation.
• Row-level authorisation evaluated on every request, with roles for dentist, assistant, patient and administrator.
• Immutable audit logging of every clinical record access, with actor, role, purpose and timestamp.
• Least-privilege internal access, reviewed quarterly, with mandatory multi-factor authentication.
• Encrypted, geographically redundant backups within India, with restore drills.
• Dependency scanning, secret scanning and code review on every change.

Incident response

We maintain a documented incident response plan with defined severity levels and on-call ownership. Where a personal data breach occurs, we notify affected fiduciaries and the Data Protection Board of India as required, and we publish a post-incident summary for material incidents.

Reporting a vulnerability

Email support@1dentist.com with enough detail to reproduce the issue. We acknowledge within one business day and aim to give a remediation timeline within five. Please give us reasonable time to fix an issue before disclosing it publicly.

Safe harbour

We will not pursue legal action against good-faith research that respects user privacy, avoids degrading our service, does not access or modify data belonging to others, and follows this policy. We credit reporters who want to be named.

Out of scope

• Denial of service and volumetric testing.
• Social engineering of our staff, clinics or patients.
• Reports generated solely by automated scanners with no demonstrated impact.
• Missing best-practice headers with no exploitable consequence.