Security

Row-level security in the database means each clinic, supplier and representative can read only their own organization’s records. The separation is enforced in the database itself, not just in the screens.

Front-desk staff do not see clinical notes or prescriptions. Suppliers and pharmacies see only the orders assigned to them, with the items and delivery details needed to fill them, and never another organization’s data, pricing or commissions. Prescription orders are released only after a licensed provider approves them.

Passwords are managed by our authentication provider and never stored by Porto MD in plain text. Porto MD team accounts sign in with a second step, a one-time code. Clinic owners can require two-step verification for everyone who opens patient records. Team and provider screens sign out after a period of inactivity.

All traffic to the website, the portals and our APIs is encrypted in transit (HTTPS/TLS). The database and file storage are encrypted at rest by our infrastructure provider.

Sign-ins, access to records and other important actions are written to an append-only audit trail, with who did it and when. Once a provider signs a visit note, the database locks it; any change is added as a visible amendment.

Features that handle real patient information stay switched off for a clinic until its Business Associate Agreement is signed. Emails and texts never include health details; they tell the person there is an update and link to a secure sign-in.

Automated checks look for security problems around the clock and alert the Porto MD team, and every change to the software is checked for known vulnerable dependencies before it ships. If an incident affects information we hold for a clinic, we contain it, investigate, and notify that clinic without unreasonable delay and within the time the law and our agreement require.

If you believe you have found a vulnerability, please email compliance@portomd.com with the details. Please do not access or change other people’s data while testing, and give us a reasonable time to fix the problem before telling anyone else. Our internal procedure is published as Security & Data Protection Practices (SOP-SEC-001).