Security by architecture, not by policy

A policy is a promise about behaviour. An architecture is a constraint on what is possible. We would rather you audit the second than trust the first.

What we hold

• Your practice account: name, address, billing contact, users.
• Nothing per analysis. Billing is per location and per month, so no analysis is ever counted or logged.
• Your platform selections and your API credentials.

What we do not hold

• No radiographs. Images pass through process memory and are released when the request closes.
• No patient identifiers, no names, no dates of birth, no record numbers.
• No findings, no reports, no clinical history.
• No training set. Your images are not used to develop any model, ours or anyone else's.

Why this changes the questions you should ask us

Encryption at rest protects an archive. Backup retention policies govern copies of an archive. Deletion procedures describe how an archive is destroyed. None of these apply where no archive exists. The question worth asking us instead is narrower and harder: can you demonstrate that nothing is written? We answer it in the data processing agreement, which states a retention period of zero seconds and describes the architecture that makes it so.

Transport and access

• TLS on every exchange, between your practice and us, and between us and each vendor.
• Each practice location has its own access token. We store only its hash, never the token itself, and we can revoke it individually on request. Revocation from your own account page is planned.
• Access to production infrastructure is restricted and logged; those logs record operator actions, never image content.

What sits outside our control

Once a radiograph reaches the vendor you selected, their retention and their security terms apply, not ours. We publish what each vendor states, and we do not speak on their behalf. This boundary is deliberate: a platform that claimed to guarantee a third party's handling of your data would be claiming something it cannot enforce.

Where the company stands

DentalClinicsAIHub is operated by SCMDSD LLC, 1603 Capitol Avenue, Cheyenne, WY 82001, United States. We hold no ISO 27001 certification and no SOC 2 report, and we do not claim either. What we offer instead is an architecture you can inspect and a contract that binds us to it.

DentalClinicsAIHub is an integration and access platform. Regulatory status belongs to each vendor for its own product.