Security is the architecture Patient Protect was built on from day one — designed by combining infrastructure patterns from clinical and government healthcare environments with clinical compliance expertise. It was assembled by our founder to solve a problem no single discipline could address alone.
Encryption is necessary but not sufficient. Patient Protect adds a defense-in-depth security layer — multiple independent controls so that compromising one does not expose the system. This architecture works alongside your existing compliance program or as your complete security foundation.
All data encrypted at rest using AES-256-GCM with authenticated encryption. ePHI is never stored in plaintext — not in the database, not in logs, not in backups.
NIST-standardized (FIPS 197). The same encryption standard used across federal government systems.
Every connection uses TLS 1.3 with forward secrecy. Downgrade attacks are blocked at the protocol level. No legacy cipher suites permitted.
HSTS enforced. Certificate transparency monitored.
No implicit trust. Every request is authenticated, authorized, and validated regardless of network origin. Session tokens are cryptographically bound to device fingerprints.
Defense-in-depth — compromise of one layer does not expose the system.
Real-time behavioral analysis detects anomalous access patterns — brute force, credential stuffing, session hijacking, and privilege escalation — before damage occurs.
Automated response pipeline: AppSensor → rate limiting → Fail2Ban → IP block.
Eight defined user roles with granular permissions. No shared accounts. Unique authentication per user with multi-factor enforcement. Session timeouts after inactivity.
Principle of least privilege enforced at every access point.
AWS-hosted with dedicated VPC, private subnets, and no public-facing database endpoints. PostgreSQL with parameterized queries — SQL injection is architecturally prevented.
Nginx reverse proxy with request filtering. No direct application exposure.
Every access, modification, and administrative action is logged with timestamp, user identity, IP address, and action detail. Logs cannot be modified or deleted by any user, including administrators.
Audit trails retained for 6+ years per HIPAA requirements.
Patient Protect commissions independent vulnerability scanning and penetration testing of the production environment. Attack surface continuously monitored. Breach simulation models real-world attack scenarios against your practice profile.
Independent security assessment — not self-reported.
Patient Protect commissions independent security testing of its production infrastructure and applications. Our most recent penetration test was completed by Pentest Tools in August 2026. Test scope, environment, and result summaries are documented internally and available under NDA on request from qualified enterprise buyers and their assessors.
This is not self-reported. Testing is performed by an external security platform against our live infrastructure. Detailed findings are not published on this page — the meaningful signal for buyers is scope, cadence, and remediation discipline, not a marketing headline.
CEO & Platform Architect
Chief Technology Officer
Chief Security Officer
Patient Protect is a HIPAA business associate. We execute a BAA with every customer and maintain our own compliance program — not as a marketing exercise, but as an operational requirement.
Patient Protect gives your practice security architecture built on the same standards used in federal systems — at a price a five-person dental office can afford.
