Where your data lives
SmileDesk runs on Indian VPS infrastructure — the primary database, the app tier and the WhatsApp gateway are all in India. Weekly (Starter), daily (Pro) and off-site S3 (Business) backups are also held in Indian regions.
Trust
Your ledger, your patient list — your data.
A clinic that gives us its records is trusting us with the business. Here's what actually happens to that data — hosting, backups, uptime, auth, export and everyone we share any part of it with.
Last reviewed today, updated whenever the answer changes.
Backups you can actually restore from
Starter clinics get a weekly database dump. Professional runs a daily dump. Business adds an encrypted off-site copy to S3 in a different Indian region. Every dump is test-restored monthly against a scratch database — a backup that was never restored is not a backup.
Uptime targets
99.5% target on Starter (about 3.6 hours downtime a month). 99.9% target on Professional and Business (about 43 minutes). Planned maintenance is scheduled outside clinic hours and announced in the in-app banner at least 48 hours ahead.
DPDP posture
We are aligned with the Digital Personal Data Protection Act, 2023. Patient records are held per-tenant, isolated at the schema level, and every write is traceable to the staff account that made it. Consent, retention and grievance details live on the DPDP page.
Auth & session model
Passwords are hashed with Argon2id (memory-hard). Session cookies are opaque tokens — only their SHA-256 hash is stored server-side — and are short-lived and rotated on every sensitive action. A password reset, a role change or a deactivation invalidates every open session immediately.
Data export
Starter can download a monthly CSV of every table their staff can see. Professional adds full on-demand CSV export at any time. Business gets a documented read-only API and a full SQL dump on request. You can leave whenever — with your ledger and your patient list.
Sub-processors
A short list, deliberately. Poruz Pay / Razorpay handles the subscription billing card capture. The Pulse gateway (also ours) sends the WhatsApp messages. Our own VPS in India hosts the app tier and database. There is no third-party analytics vendor watching your clinic staff.
Incident response
A security or data-loss incident goes to security@poruz.com. An engineer will acknowledge within 4 working hours (typically much faster) and post the first status update within 8. Affected clinic owners are contacted directly — not left to read a status page.
Still have a question?
DPDP consent, data retention and grievance officer contacts live on the DPDP page. For anything else — an audit request, a hosting question, a sub-processor query — email us directly.