How we protect your practice’s data
What is in place today, what we are still working on, and how to report a vulnerability.
In place today
Encryption
HTTPS (TLS) for all traffic. Clinical records, check-in answers and authenticator secrets are encrypted at rest with AES-256-GCM.
Sign-in
Hashed session tokens, two-factor authentication with single-use recovery codes, optional single sign-on, and team rules that require two-factor or single sign-on.
Access and audit
Records are private unless you share them with your team. An append-only audit log records changes, access to shared records, exports and admin actions.
Backups
Nightly backups, encrypted before they leave the server, kept off-site in Stockholm for up to 35 days.
Minimal data to providers
AI and transcription providers receive only what the task needs and may not train on it. Analytics never include clinical content.
Admin access
Every Docdemic administrator must use two-factor authentication, and administrative actions are logged against the affected account.
Independent testing
We are planning an external penetration test by an independent security firm. It has not taken place yet, so we do not publish or claim any results. When it is done we will summarise the outcome here and share the report with customers under a confidentiality agreement.
Docdemic does not currently hold a security certification such as ISO 27001 or SOC 2.
Report a vulnerability
If you believe you have found a security problem in Docdemic, email us with the details and steps to reproduce. We will acknowledge your report, keep you informed and credit you if you wish.
Please do not access, change or delete other people’s data, run tests that degrade the service, or use social engineering. Use only your own test accounts, and give us reasonable time to fix an issue before disclosing it.