Security and data handling

Overview

This page describes how OccluTrace protects account access, uploaded scan files, generated results, and billing. The providers we use are named on the Subprocessors page. This page does not publish server locations, internal network structure, or live processing architecture. That level of detail is available through enterprise security review, contractual review, or regulator and auditor requests under appropriate confidentiality.

Data protection

• Connections to the Service use HTTPS, and the site tells browsers to use HTTPS only.
• Uploaded files and generated artifacts are stored in private object storage and are reached through short-lived signed links.
• Access to case files is account-scoped and checked on the server for every request.
• Administrative actions and sensitive account events are written to an audit log.
• Card details are entered on the payment processor’s hosted checkout page and are not stored by us.

Scan handling

Files are processed only to provide the alignment, preview, design, and export workflows you request. Scans sent for server-side processing reach the processing server through a signed request for that job, and results are written back to private storage.

Uploaded scan files are automatically deleted 90 days after the job is created, as described under Retention in the Privacy Policy.

Customer scans, cases, designs, and results are never used to train, fine-tune, or improve any model.

Account access

• Users sign in before accessing account, dashboard, scan, and export data.
• Passwords are stored as salted bcrypt hashes. New passwords are checked against a list of known breached passwords without sending the password or its full hash.
• Two-factor authentication is available with an authenticator app or an email code. Authenticator secrets are encrypted at rest and recovery codes are stored hashed.
• Sign-in, registration, password reset, and other sensitive endpoints are rate limited. Changing a password and deleting an account require a recent sign-in.
• You can sign out of all devices from your Account page, and we email you when a password sign-in comes from a new IP address.
• Case access is scoped to the authenticated account or authorized organization.
• Administrative access is limited to designated administrator accounts, and administrative actions are logged.

Application security

• Upload flows validate file type, size, ownership, and job state.
• Public endpoints are protected by server-side input validation, rate limits, and security headers, including a per-request content security policy.
• Errors shown to users are sanitized to avoid leaking internal details.
• Reports sent to the error monitoring service have request bodies, headers, cookies, and patient-bearing fields removed first.

Service providers

We use service providers to operate the product. The Subprocessors page lists each provider by name, what it does, and the data it handles.

HIPAA and BAA

OccluTrace’s safeguards are aligned with the HIPAA Security Rule for the dental scans and case data you upload. HIPAA has no official certification; we assess our safeguards against the Security Rule ourselves and review them every year.

• The application, its database, uploaded files, backups, and email run on Amazon Web Services under a signed AWS Business Associate Addendum.
• AI steps that need a GPU run on rented cloud compute outside AWS. They receive a de-identified geometry-only copy (no names, file names, dates or account data) under a code that carries no patient or account details, deleted within about two days; that copy is not PHI and is not covered by the AWS agreement.
• Data is encrypted in transit (TLS 1.2 or newer) and at rest (encrypted disks, storage, and backups).
• Access is limited to your account and authorized organization. Staff access is limited to designated administrators, and every administrative opening of a case is logged.
• The database is backed up continuously, and a restore is tested every week.

We sign a Business Associate Agreement with HIPAA covered entities and with business associates, such as dental labs that work for them. To request one, write to contact@occlutrace.ai from the email of your OccluTrace account and name the organization that will sign; we send our BAA for signature. If HIPAA applies to you, upload protected health information only after it is signed, and send it through the application, not by email. See the Terms of Service.

Incident response

We maintain an incident response process for security events affecting confidentiality, integrity, or availability. If we confirm an incident affecting customer data, we notify affected users without undue delay and as required by applicable law or contract. Where we hold data on behalf of a dental lab or practice, including protected health information, we tell that customer promptly, and within 10 days of discovering the breach (Florida law, s. 501.171, requires this of a third-party agent).

Notifications include the nature of the incident and the data involved where known, the steps we are taking, and recommended customer actions when applicable.

Customer controls

• Delete cases that should no longer be available in the dashboard.
• Use a strong password, turn on two-factor authentication, and protect your email.
• Limit team access to users who need it for lab or clinical workflow.
• Contact support immediately if you suspect unauthorized account access.

Vulnerability reporting

Send good-faith reports of security issues to contact@occlutrace.ai. We will acknowledge security reports within five business days.