Dash Security Overview

Security posture

Dash is designed to support HIPAA-regulated clinic operations with tenant scoping, role-based access, authentication hardening, audit logging, secure session cookies, security headers, and separated data boundaries for sensitive workloads. For the HIPAA shared-responsibility model and a safeguard-by-safeguard status map, see the HIPAA page.

Core controls

• Role-based and organization-scoped authorization for staff workflows.
• Separate authentication surfaces for staff and patient portal users.
• Secure, httpOnly session cookies with strict same-site behavior where appropriate.
• Audit events for sensitive staff authentication and administrative activity.
• Origin checks and default-deny API middleware for protected dashboard routes.
• Operational redaction to reduce accidental exposure of secrets, credentials, and sensitive data.

Infrastructure and vendors

Dash uses reputable cloud, database, payment, messaging, email, security, support, and AI providers to operate the platform. Vendor use is limited to the services needed to deliver Dash and is subject to contractual, security, and compliance review.

Customer responsibilities

Clinics remain responsible for staff access reviews, device security, appropriate workflow configuration, legal review of clinic policies, patient consent collection, integration authorization, and workforce compliance training.

Security contact

Report suspected vulnerabilities or security concerns to security@connectdash.ai. Do not include live patient data unless requested through a secure support channel.