# Security (/docs/en/trust/security)



This page lists the security controls you can check in the product and in Salisan's infrastructure configuration. It is not a certification and does not replace the [Terms of Service](https://salisan.com/legal/terms) or the [privacy policy](https://salisan.com/legal/privacy).

## Sign-in protection [#sign-in]

Accounts sign in with email and password, with Google, with a passkey, or through the practice's single sign-on.

* Passwords must be 8 to 128 characters. Salisan rejects passwords found in known data breaches. The check sends only the first five characters of a hash of the password to the Have I Been Pwned range service.
* A new email-and-password account must confirm its email address with a code before it can sign in.
* Password recovery uses a code sent by email.
* Sign-in, sign-up, email-code and recovery requests are rate limited.
* Session cookies are marked secure.

## Two-factor authentication [#two-factor]

Each person can turn on two-factor authentication with any authenticator app. Salisan shows one-time recovery codes during setup. Each code works once.

The practice owner can require an authenticator for every member under **Organization → Settings → Two-factor**. Only the owner can change this policy. Passkeys do not satisfy the requirement.

When the policy is on, the server checks it on requests for practice data. A member without an authenticator is asked to set one up before they can continue. The sign-in session must also have been created with, or stepped up through, an authenticator code.

## Single sign-on [#sso]

Single sign-on is available on the Enterprise plan. The practice connects Microsoft Entra ID or another OpenID Connect provider approved by Salisan support, verifies the clinic email domain with a DNS record, and tests the sign-in.

The owner can then choose **Require SSO for clinic members**. This blocks local sign-in for members. The owner account keeps local sign-in and two-factor for emergency access, and the settings page shows whether the owner account is ready before enforcement. Single sign-on does not create accounts. A person must be invited first.

## Sessions and alerts [#sessions]

Under **Settings → Security → Sessions**, each person can see their active sessions, revoke one, or choose **Revoke other sessions**. Changing a password signs out the other sessions.

Salisan sends a notification when a sign-in comes from a device the account has not used before. It also notifies when a password, email address or passkey changes, and when two-factor is turned on or off. Sign-in alert data is kept for 90 days, as the privacy policy states.

## Encryption and storage [#encryption]

Salisan's infrastructure configuration sets the following:

* The web apps redirect to HTTPS and require TLS 1.2 or later.
* The application connects to the database over TLS with certificate verification.
* The cache requires encrypted connections and encrypts data at rest.
* Database storage, file storage and database backups are encrypted at rest.
* Storage buckets block public access.
* Production database backups are kept for 35 days.

The privacy policy describes security measures as encryption in transit and at rest, role-based access, two-factor authentication and audit logging.

## Not published yet [#not-published]

No security certification, penetration test report or completed security questionnaire is published. If your review needs one, write to [privacy@salisan.com](mailto:privacy@salisan.com) and describe what you need.

See [Access and audit](/docs/en/trust/access-and-audit) for roles and the audit log, and [Account and security](/docs/en/get-started/account-and-security) for the steps each person follows.