What we do to protect your data — and what we don't claim yet.
Dozorvexa handles clinical and customer records, so we'd rather tell you exactly where we stand than hide behind badges. This page describes the controls that are live today, the third parties that process data on our behalf, and our current certification status.
Last updated: August 2026
Controls in place today
Encryption
All traffic is served over TLS 1.2+. Customer data is stored in a managed Postgres database with encryption at rest provided by the hosting platform.
Access control
Each tenant's data is isolated with row-level security policies enforced at the database layer. Application roles (owner, admin, staff) gate what each team member can see and change.
Audit logging
Changes made by users and by the AI Copilot — patient, appointment, workflow, and billing events — are written to an audit log with actor and timestamp, viewable in-app.
Infrastructure
Dozorvexa runs on managed cloud infrastructure with automated database backups and point-in-time recovery provided by our database host.
Certification status
SOC 2
Dozorvexa does not currently hold a SOC 2 Type I or Type II report, and we do not publish one. If a SOC 2 report is a hard requirement for your practice or company, email security@dozorvexa.com — we'll be straight with you about timelines rather than sell around it.
HIPAA
HIPAA has no certifying body, so no vendor can be "HIPAA certified." What we can describe is our posture: tenant-isolated storage, role-based access, audit logging of record changes, and encryption in transit and at rest. Practices that require an executed Business Associate Agreement before storing PHI should contact security@dozorvexa.com so we can confirm where that stands before you migrate any patient data.
Subprocessors
These third parties may process customer data on our behalf. We update this list when it changes.
| Subprocessor | Purpose |
|---|---|
| Supabase | Managed Postgres database, authentication, file storage |
| Cloudflare | Application hosting, CDN, TLS termination |
| Stripe | Subscription billing and payment processing |
| Twilio | Voice and WhatsApp messaging for the AI Receptionist add-on |
| Google (Gmail / Calendar APIs) | Optional calendar and email integrations, enabled per customer |
| AI model providers (OpenAI, Google Gemini) via our AI gateway | AI Copilot inference, transcription, and summarization |
Reporting a vulnerability
Email security@dozorvexa.com with steps to reproduce. We aim to acknowledge reports within two business days. Please don't run automated scans against production or access data that isn't yours — report the path and we'll reproduce it.