Security

This page lists the security controls you can check in the product and in Salisan's infrastructure configuration. It is not a certification and does not replace the Terms of Service or the privacy policy.

Sign-in protection

Accounts sign in with email and password, with Google, with a passkey, or through the practice's single sign-on.

• Passwords must be 8 to 128 characters. Salisan rejects passwords found in known data breaches. The check sends only the first five characters of a hash of the password to the Have I Been Pwned range service.
• A new email-and-password account must confirm its email address with a code before it can sign in.
• Password recovery uses a code sent by email.
• Sign-in, sign-up, email-code and recovery requests are rate limited.
• Session cookies are marked secure.

Two-factor authentication

Each person can turn on two-factor authentication with any authenticator app. Salisan shows one-time recovery codes during setup. Each code works once.

The practice owner can require an authenticator for every member under Organization → Settings → Two-factor. Only the owner can change this policy. Passkeys do not satisfy the requirement.

When the policy is on, the server checks it on requests for practice data. A member without an authenticator is asked to set one up before they can continue. The sign-in session must also have been created with, or stepped up through, an authenticator code.

Single sign-on

Single sign-on is available on the Enterprise plan. The practice connects Microsoft Entra ID or another OpenID Connect provider approved by Salisan support, verifies the clinic email domain with a DNS record, and tests the sign-in.

The owner can then choose Require SSO for clinic members. This blocks local sign-in for members. The owner account keeps local sign-in and two-factor for emergency access, and the settings page shows whether the owner account is ready before enforcement. Single sign-on does not create accounts. A person must be invited first.

Sessions and alerts

Under Settings → Security → Sessions, each person can see their active sessions, revoke one, or choose Revoke other sessions. Changing a password signs out the other sessions.

Salisan sends a notification when a sign-in comes from a device the account has not used before. It also notifies when a password, email address or passkey changes, and when two-factor is turned on or off. Sign-in alert data is kept for 90 days, as the privacy policy states.

Encryption and storage

Salisan's infrastructure configuration sets the following:

• The web apps redirect to HTTPS and require TLS 1.2 or later.
• The application connects to the database over TLS with certificate verification.
• The cache requires encrypted connections and encrypts data at rest.
• Database storage, file storage and database backups are encrypted at rest.
• Storage buckets block public access.
• Production database backups are kept for 35 days.

The privacy policy describes security measures as encryption in transit and at rest, role-based access, two-factor authentication and audit logging.

Not published yet

No security certification, penetration test report or completed security questionnaire is published. If your review needs one, write to privacy@salisan.com and describe what you need.

See Access and audit for roles and the audit log, and Account and security for the steps each person follows.