Security and patient data

Chairside Payroll calculates provider pay from your practice management exports. This page explains what happens to that data, what we keep, and the controls around it, in plain terms.

What happens to your export

• The file is read in your browser. Patient names are removed on your computer before anything is sent. Your own file stays in your browser for up to 24 hours, or until you remove it. Nothing in it is sent until you calculate pay under your account, unless you choose to send us a sample, with patient details removed.
• Columns that identify patients (names, dates of birth, contact details, chart and account numbers, Social Security numbers) are removed first. After that, only the columns pay is calculated from are kept; anything else in the file, such as notes or descriptions, is dropped.
• What we store for each line: the transaction ID, service date, provider, procedure code and dollar amounts (production, adjustments, lab fees, collections).
• Pay is worked out on our servers: those same lines (never patient details, never the file) are sent over an encrypted connection to be calculated, and kept as a payroll run only when you save it. To bill each provider's seat by the work they do, we also note the procedure codes and fees under each provider when pay is calculated: never patient details or other protected health information (PHI). Visitors trying the public demo with their own export send nothing: it stays in their browser.

Why we still treat it as sensitive

No patient names are stored, but a transaction ID and service date can be traced back to a patient in your own system. We protect stored payroll data with that in mind, and we ask you not to type patient details into notes. Free-text fields such as issue descriptions and adjustment reasons warn you when what you type looks like a name, phone number, date of birth or account number.

Who can see and change what

• Each practice’s data is kept separate by the database itself, not only by the app’s screens.
• Roles decide what each person can do: viewers see runs and reports on screen; reviewers prepare runs; payroll managers approve and export; admins and owners manage providers, settings and the team.
• Two-step verification (a passkey or an authenticator app) is required by default in new practices before anyone approves pay, exports to payroll or changes settings. Backup codes cover a lost phone.
• Where offered, if you choose sign-in codes by text message, we first text a code to confirm your number, and after that codes go only to that number; each lasts 10 minutes and works once, and only a few can be sent an hour. Our own staff sign in with a passkey, never a texted code.
• Signed-in sessions end after 15 minutes without activity, with a warning first.
• Passwords must be at least 12 characters, with uppercase and lowercase letters, a number and a symbol (or a space), and are checked against lists of known leaked passwords.

A record of every change

Approvals, reopenings (with the reason), exports to Gusto or ADP, manual pay entries and line adjustments are recorded with who made them and when. Approved runs are locked; changing one means reopening it, which is recorded too.

Where data lives

• Hosting, database and sign-in: Amazon Web Services (AWS) in the United States, under AWS's business associate agreement. Data is encrypted at rest with managed keys, every connection to us is encrypted (TLS), and the database is backed up daily.
• The site is served only over HTTPS.
• Email (sign-in links, invitations and notices): Amazon SES. Emails never contain patient details, provider names or what any provider is paid. The one exception is the approval email for a one-off bonus, which names the provider and the amount so the approver knows what they’re approving. A trial reminder may give the practice's overall differences found.
• When an export's layout is new to us, its column headings, and a few lines with every value replaced by its kind (such as “date” or “amount”), with counts for each column such as how many different values it holds, go to an AI model on Amazon Bedrock, inside AWS. Patient details, names and amounts never leave your browser (procedure codes do, as the Privacy page says), and the file itself is never sent. AWS doesn't keep it or train on it. Each match is shown in the file check for you to confirm.
• When you upload a provider's contract, it's read for their pay terms: the contract's text is taken from the file in your browser, Social Security, tax ID, DEA, phone and long account numbers are removed, and the text goes to the same AI model on Amazon Bedrock. The file itself isn't uploaded or kept, and AWS doesn't keep the text or train on it. Each term is shown beside the contract's own sentence, and nothing is saved until you confirm it.
• Error reports stay in our own systems on AWS. Reports carry the error and the page it happened on; form contents, cookies, email addresses and phone numbers are removed first. When our team passes a problem to development, a short summary goes to our issue tracker (GitHub). It holds only the app's own words: no patient or practice details, and no rows, amounts or dates of service.

Business associate agreement

Every practice accepts our business associate agreement before its first upload, at no extra cost. See also our Privacy Policy.