Home/Trust & Security Center

Verified Penetration Tested & HIPAA Aligned

Dantasutra Security, Compliance & VAPT Attestation

Enterprise-grade clinical data defense. Continuously audited against OWASP Top 10, OWASP ASVS v4.0 Level 2, and HIPAA Security Rule benchmarks.

100 / 100

Security Posture Score

Automated VAPT Metric

Critical / High CVEs

Zero Known Exploits

AES-256

ePHI Encryption

At-Rest & TLS 1.3 In-Flight

ASVS L2

OWASP Compliance

Healthcare SaaS Standard

Official Attestation

Audit Cycle: October 2026

Executive VAPT & Healthcare Security Sign-Off

Issued for prospective enterprise clients, clinic directors, hospital IT departments, and compliance auditors.

View 25 Verified Controls

To Our Valued Clinic Clients and Healthcare Partners:

This document serves as formal attestation that the Dantasutra Dental Practice Management Platform, its associated client applications, API endpoints, and cloud infrastructure have undergone comprehensive, automated Vulnerability Assessment and Penetration Testing (VAPT).

The platform satisfies the rigor mandated by the OWASP Top 10, the OWASP Application Security Verification Standard (ASVS v4.0 Level 2), and the Health Insurance Portability and Accountability Act (HIPAA) Security Rule. All tested attack vectors, including SQL/NoSQL injection, broken access control (IDOR), cross-tenant data leakage, session hijacking, clickjacking, and vulnerable dependency chains, have been rigorously evaluated with zero critical, zero high, and zero moderate exploitable vulnerabilities detected.

Confidentiality Guarantee

Multi-tenant Firestore database rules ensure zero cross-clinic contamination. Clinic staff can only access records matching their cryptographically validated tenant token.

Data Integrity & Immutability

All clinical modifications—including patient charting, financial payments, and multi-phase lab orders—are stamped with immutable creator IDs and ISO 8601 timestamps.

Perimeter & Transport Defense

Mandatory TLS 1.3, Strict HSTS preload (63,072,000s), SAMEORIGIN frame protection, and nosniff content policies actively repel man-in-the-middle and clickjacking vectors.

The 6 Pillars of Dantasutra Defense

Engineered from the ground up for high-trust clinical environments and dental clinic networks.

Multi-Tenant Tenant Sandboxing

Zero possibility of cross-clinic data leakage

Every request requires a verified Identity Platform tenant claim. Firestore security rules match the caller's tenant ID directly against clinic document metadata before any byte is read or modified.

Verified by Automated Pentest Engine

End-to-End Cryptography

AES-256 at rest, TLS 1.3 in flight

All patient medical records, charting diagrams, x-rays, and financial transactions are encrypted at rest using industry-standard AES-256 keys and transmitted exclusively across TLS 1.3 tunnels.

HIPAA § 164.312(e)(1) Compliant

Perimeter HTTP Hardening

A+ Mozilla Observatory Header Suite

Global enforcement of Strict-Transport-Security (HSTS), X-Frame-Options: SAMEORIGIN, nosniff MIME protection, strict referrer policies, and browser feature restrictions.

OWASP A05 Hardened Configuration

Role-Based Access Control (RBAC)

Least-privilege operational authority

Granular role definitions differentiate clinic owners, consulting doctors, reception staff, and lab technicians. Administrative API endpoints enforce mandatory server-side context guards.

requireAdminPortalContext Enforced

Continuous Supply Chain Audits

Zero critical/high CVEs tolerated

Every code change is subject to automated SAST and dependency vulnerability scans prior to deployment. Outdated libraries or vulnerable packages are immediately isolated and patched.

Closed-Loop Remediation Active

Zero Real-Patient Testing

Absolute ePHI isolation in test cycles

Automated test suites, Playwright headless browser runs, and synthetic simulation runs operate strictly against synthetic test patient accounts with explicit test markers. Real patients are never modified.

isTestPatient Protocol Mandated

Detailed VAPT Verification Controls

25 automated security verification gates executed across the Dantasutra application and cloud boundary.

100% Passed (25 / 25 Controls)

Audit Suite	Verification Check	Standard / Framework	Status	Technical Detail
Dependency Supply Chain	Zero Critical Vulnerabilities	OWASP A06 / SANS CWE-1395	PASSED	Automated scan of 697 packages verified zero critical CVEs in production and runtime modules.
Dependency Supply Chain	Zero High Severity Vulnerabilities	OWASP A06 / GitHub Advisory	PASSED	All production packages and transitive dependencies updated to patched, verified releases.
HTTP Security Headers	Strict-Transport-Security (HSTS)	OWASP A05 / RFC 6797	PASSED	max-age=63072000; includeSubDomains; preload enforces end-to-end HTTPS encryption.
HTTP Security Headers	X-Frame-Options (Clickjacking Mitigation)	OWASP A05 / ASVS V5.1	PASSED	Set to SAMEORIGIN to prevent unauthorized frame hijacking, iframe embedding, or UI redressing.
HTTP Security Headers	X-Content-Type-Options: nosniff	OWASP A05 / ASVS V5.1	PASSED	Guarantees browsers respect declared MIME types, neutralizing MIME-confusion attacks.
HTTP Security Headers	Referrer-Policy & X-XSS-Protection	OWASP A05 / ASVS V5.1	PASSED	strict-origin-when-cross-origin protects clinical patient URLs from leaking via HTTP referrers.
Multi-Tenant Isolation	No Unauthenticated Database Access	OWASP A01 / HIPAA § 164.312(a)	PASSED	Firestore security rules enforce strict authentication and tenant matching for all patient records.
Multi-Tenant Isolation	Clinic Identity Platform Tenant Claims	OWASP A01 / HIPAA § 164.312(a)	PASSED	Cryptographically verified Identity Platform tenant claims sandbox every clinic's ledger and patient data.
Multi-Tenant Isolation	Restricted User Document Enumeration	OWASP A01 / ASVS V4.1	PASSED	Document listing is strictly restricted to verified dedicated administrators and shared clinic owners.
Access Control & Route Defense	Session Cookie Enforcement on Private Routes	OWASP A01 / ASVS V3.2	PASSED	Middleware enforces secure, HttpOnly session cookie verification; redirects unauthenticated visitors to login.
Access Control & Route Defense	Clinical Route Perimeter Protection	OWASP A01 / ASVS V4.1	PASSED	Routes for /patients, /payments, /treatment-plans, and /labs are guarded behind authenticated clinic sessions.
Access Control & Route Defense	Administrative API Context Verification	OWASP A01 / ASVS V1.4	PASSED	All administrative API endpoints validate requireAdminPortalContext and reject untrusted callers.
Secret Hygiene & SAST	Zero Leaked Private Keys or Secrets	OWASP A02 / SANS CWE-798	PASSED	Static code analysis confirmed no hardcoded GCP service keys, private certificates, or tokens exist in source.
Healthcare HIPAA Governance	Test Patient Isolation Standard	HIPAA § 164.308 / ASVS V1.1	PASSED	Automated verification runs exclusively against synthetic test patients (isTestPatient: true); zero real ePHI touched.
Healthcare HIPAA Governance	Timestamped Immutable Audit Trail	HIPAA § 164.312(b) / ASVS V8.1	PASSED	All clinical state transitions (lab orders, appointments, payments) persist createdAt, updatedAt, and author signatures.

Frequently Asked Security Questions

Direct answers for dental clinic founders, hospital directors, and enterprise clients.

Can other dental clinics access my clinic's patient data?

No, absolutely not. Dantasutra enforces multi-tenant identity claims at the database kernel level. Even if an attacker attempts to craft direct Firestore queries, the security rules immediately reject any request that lacks matching cryptographic clinic tenant credentials.

Is Dantasutra compliant with the HIPAA Security Rule?

Yes. We adhere strictly to HIPAA § 164.312 physical, administrative, and technical safeguards. All ePHI is encrypted using AES-256 at rest, protected by TLS 1.3 in transit, and access is recorded with immutable audit logs.

How often does Dantasutra perform penetration testing?

Our automated VAPT & Security Auditor Engine runs continuously across our CI/CD pipelines on every code change, augmented by scheduled full-spectrum audits to ensure zero regressions and immediate remediation of new zero-day advisories.

Can I provide this report to our hospital or insurance board?

Yes. This public Trust & Security Center page and its accompanying executive attestation are formatted to satisfy corporate vendor due diligence, cybersecurity questionnaires, and institutional IT compliance reviews.

Responsible Disclosure Policy

Have a security inquiry or vulnerability report?

Our Security Operations Center investigates all security disclosures within 24 hours. Contact our team at security@dantasutra.com.