The claim isn't "we're secure". It's that the numbers are right, and you can prove who changed them.
Nojdar is multi-tenant, and isolation is enforced three times over: every database query is scoped to your clinic, every API procedure verifies the session, the membership, the role and the subscription before it runs, and the interface only renders what the role can do. The clinic is always derived from the authenticated session, never from anything the browser sends, so list and lookup endpoints cannot leak across clinics.
Every change to patients, visits, prescriptions, diagnostics, invoices, payments, expenses and staff membership writes an audit entry in the same database transaction as the change itself. If the change commits, the audit entry commits; there is no window where one exists without the other. Each entry records the actor, their role at the time, the action, before and after snapshots, IP address, browser and timestamp. Snapshots pass through a default-deny allowlist, so sensitive fields never enter the log, including columns added later.
Permissions are declared per resource and action, and they are deliberately granular: dispensing and correcting a dispense are different permissions; entering a result and verifying it are different; reading the audit log and exporting it are different. A dedicated auditor role can read and export the log and nothing else: the right access for an accountant or compliance reviewer.
Monetary values are stored as fixed-precision decimals, never floating point. Totals are computed on the server; a client can never submit its own total. Every payment must be in its invoice's currency. Mixed-currency arithmetic is rejected at the API. Invoices and payments are never hard-deleted: a void carries a required reason, a refund is its own linked record, and receipts are versioned rather than overwritten.
Patient attachments, generated PDFs and receipts are stored on S3-compatible object storage and served only through short-lived presigned URLs after a clinic check. Nothing patient-linked is ever served directly from the bucket.
Email verification, passkeys (biometric or hardware key), two-factor authentication and magic links. Every user can see all devices signed in to their account and revoke any of them. Public endpoints such as prescription verification are rate-limited and return only a minimal, non-clinical payload.
If a subscription lapses you get a 7-day grace period with full access, then the clinic switches to read-only. Staff can still look everything up, an administrator sees a clear resolution screen, and nothing is deleted. Patients, visits, invoices, payments, expenses and reports export as CSV at any time.
Write to us. We answer specific questions with specific answers.
Contact us