Security

Last updated: 2 November 2026

Dental records are among the most sensitive information there is. This page describes how Symly protects them, so your practice can review us as a supplier.

Where information is kept

Symly runs on providers that keep information in the UK or the European Economic Area. Our sub-processors page lists each one and what it handles.

Encryption

• Every connection to Symly uses HTTPS, and browsers are told never to connect without it.
• Symly connects to its database over encrypted connections that check the database’s certificate.
• When a practice works offline, the records downloaded to a device are encrypted, and they are removed when the person signs out or switches practice.

Signing in

• Staff passwords must be at least 15 characters, and are stored only in a scrambled form that cannot be turned back into the password.
• Repeated wrong passwords are slowed down for the address they come from, without locking the real person out.
• A staff session ends 12 hours after signing in and is never extended.
• A practice can require an emailed code each time a member signs in.
• Patients sign in to the portal with single-use emailed links that stop working after 15 minutes, so they have no password to lose.
• Practice tablets pair with one-time codes, and the practice can revoke a tablet at any time.

Keeping practices apart

Every practice’s records are separated inside the database itself, by rules that refuse access unless the request belongs to that practice. Symly works out which practice a request belongs to on its own servers, never from what a browser sends, and the apps connect with an account that has only the access they need.

Who can see what

Each member’s role and permissions decide what they can see and change, and only practice managers can manage staff access.

Activity record

Symly records sign-ins, access to patient records and changes to them, with who did it and when. The apps cannot alter or delete this record, and practice managers can review it.

Documents and messages

• Patient documents are kept in private storage, and each download uses a link that works for 60 seconds.
• Messages from our email and text message providers are checked for a valid signature before Symly acts on them.
• Error reports have patient details, internet addresses and cookies removed before they leave Symly.

How we build Symly

Every change to Symly runs automated tests, including checks that every part of the app that receives requests checks who is asking and what they may do. The code is scanned for leaked secrets and for known weaknesses in the software it depends on. The apps also use a strict content security policy, which stops pages running scripts they did not come with.

Leaving Symly

A practice manager can download a complete copy of the practice’s data at any time.

Reporting a security concern

If you think you have found a security problem, email support@symlydental.com. Please do not test against live practices or patient data.