You are about to hand a vendor a copy of your patient records. The right questions are what they take, where it goes, who can see it and what happens when you leave. This page answers them and links to the detail, including the parts that are not finished.
What are the three things to know?
- Built for HIPAA, with a BAA sent at sign up. Calibic creates, receives and stores protected health information on your behalf, which makes us your business associate. We send a Business Associate Agreement with every sign up and it is accepted during setup. We do not say “HIPAA certified” because there is no such certification. Detail: HIPAA, the BAA and what Calibic does with PHI.
- Read-only toward your practice software. The agent on your server reads Open Dental, Dentrix or Eaglesoft and has no code that writes. On Open Dental the session itself is set to read only; on Eaglesoft the connection string says
ReadOnly=YES. It cannot post a payment, book an appointment or delete anything. Detail: Security. - We say what we cannot see. Every check that cannot run on your system is shown as not covered, never left silent. Detail: Coverage.
What does Calibic store?
Patient demographics, appointments, treatment plans, procedures, the ledger (payments, adjustments, claims) and insurance details from your practice system, plus the change events the audit trail is built from. Conditions, allergies and medications feed the patient card. The text of clinical notes is not read. No card or bank account numbers are read. Data is hosted on Microsoft Azure in the United States.
What do we not have yet?
Honest list, as of 2026-10-13:
| Item | Status |
|---|---|
| SOC 2 report | None. No engagement has started. |
| Independent penetration test | None yet. |
| Multi-factor authentication | Not built. Sign-in uses a one-time email code, which is a single factor. |
| SSO for groups | ROADMAP |
| Public status page | Not built. |
| Vulnerability disclosure policy | Not published. Email hello@calibic.com with “Security” in the subject. |
| Published data retention schedule | Being written; see Security for what applies today. |
If any of these is a hard requirement for your practice or group, tell us before a demo rather than after.
What is on each page?
- HIPAA and the BAA: our role, what PHI we hold, what the BAA commits us to, how AI features touch patient data.
- Security: the read-only connectors, encryption in transit, what is stored where, who can sign in and what owners can see.
- Privacy policy and Terms of service: drafts, marked as such, pending review by counsel.
- Why read-only integrations are safer: the general case, not just ours.
- Dental practice data security checklist: for your own office, whether or not you use Calibic.
Who do I talk to?
hello@calibic.com. Put “Security” in the subject for anything that should be read first. Do not include patient information.
Next step: read what the BAA covers, or see what Protect does with the change events we hold.