On this page
A dental clinic's first question is usually the same one: is our patient data safe? This page answers it plainly, in the order a real security review would check it. We do not claim a certification MTS has not obtained, and we mark anything not yet built as planned rather than implying it already exists.
1. Authentication
- Every dashboard sign-in runs through Supabase Auth, no passwords are stored or handled by our own servers.
- A signed-in session is resolved server-side on every request, the browser never holds a value it could tamper with to access another clinic's data.
- Accounts are provisioned per clinic, there is no public self-serve signup.
2. Tenant Isolation
- Every clinic's data is scoped by Postgres Row-Level Security (RLS) policies at the database level, not only filtered in application code.
- A signed-in user's tenant is derived from their authenticated session, never from a URL parameter or request body.
- This isolation has been verified with a live cross-tenant attack simulation on both a read and a write, data resolved to the caller's own clinic in both cases, never another clinic's.
3. Encryption
- All traffic to the dashboard and its APIs is encrypted in transit (TLS/HTTPS).
- Data at rest is encrypted by our infrastructure providers (Supabase/Postgres, Vercel) as a platform-level default, not a bespoke MTS control.
4. Automation and Agent Endpoints
- The webhooks that power our AI agents require a shared-secret header on every request, they do not accept calls from anyone who does not hold it.
- That secret is injected by our own server, never exposed to the browser or any client-side code.
5. Access Control
- Role-based access within the dashboard: clinic owner and staff roles for a clinic's own team, and separate support roles for our team with no default access to any specific clinic's data.
- Our team's access to a clinic's live data is exceptional, not routine, and limited to what is needed to resolve a support request.
6. Account Security
Two-factor authentication and SSO for staff are on our roadmap and visible as settings in the dashboard, they are not yet wired to enforcement, so we do not describe them as active controls today. Session timeout is similarly planned, not yet enforced. This section will be updated the moment each control is actually live, not before.
7. Backups and Availability
Backups are managed by our database provider's standard backup capabilities. We are transparent that our current infrastructure tier is scaling alongside client growth, and that we have not yet defined a specific backup cadence to publish here. Ask us directly if this is material to your evaluation.
8. Reporting a Security Issue
Found something? Email security@mtsrev.com directly, we treat security reports as priority regardless of how they arrive.
Related documents