Access limited to the right people
Patient and practice workspaces require sign-in. Protected requests validate the user's session, and database access rules restrict appointment records to the patient, the relevant practice owner and authorized administration. Public dental-office pages do not include private appointment-request details.
Practice ownership is reviewed
New dental-office accounts require administrator approval before they can claim or create a listing. Claiming an existing practice involves a reviewed ownership request and an emailed verification code. Registering an account alone does not grant control of a public listing.
Separate administrative permissions
Administrative appointment views and exports require an authenticated account with the administrator role. These permissions are checked on the server as well as through database access rules; hiding a button is not the security boundary. Patient-request information is kept separate from the public directory.
Safer notifications and exports
Appointment email templates escape user-provided text before rendering it. Appointment CSV exports escape fields and neutralize spreadsheet formulas, reducing the risk that patient-entered content executes when opened in a spreadsheet. Sensitive request details are not public listing content.
Private credentials stay server-side
Privileged database credentials and email-service credentials are used in server-side code, not in the browser application. Public browser configuration is separate from those private credentials. Protected server operations check account permissions before performing restricted actions.
Protecting your account
Use a strong, unique password and do not share your sign-in details or verification codes. Sign out on shared devices. Share only the information needed to arrange your appointment; do not enter payment-card details or upload medical records into appointment notes. Your dental office remains responsible for its clinical records and systems.
Clear scope, honest assurances
These safeguards reflect implemented application controls, not a certification or an independent security audit. Dentli does not claim SOC 2, ISO 27001, HIPAA certification, guaranteed uptime, continuous security monitoring or independently verified backup and recovery commitments. Provider infrastructure protections and applicable legal obligations require separate verification; no online service can guarantee absolute security.
Report a concern responsibly
If you suspect unauthorized access, stop using the affected session and contact the Dentli team through your existing correspondence. Describe the affected page and what happened without including passwords, verification codes or patient information. Do not access another person's records or publish sensitive details while reporting a concern.
Last updated 2026.