Security at the core
How VetOS protects clinic data and clinical operations.
Authentication
Email/password and Google sign-in, session persistence, password reset, and clear errors for invalid credentials, unverified accounts, and expired links.
Tenant isolation
Every core record carries explicit organization and clinic keys. Row-level security enforces isolation server-side — never relying on frontend filtering alone.
Role-based permissions
Receptionist, Vet Tech, Veterinarian, Clinic Admin, and IT Admin roles with distinct read, write, and finalize scopes. Platform super-admin is separate from clinic administration.
Audit logging
Immutable-style audit history for sensitive activity: role changes, SOAP finalization, invoice void, inventory adjustments, vendor connections, and platform-admin actions.
Secure integrations
Provider credentials are stored securely and accessed only through backend functions. Secrets are never exposed to the browser or audit logs.
Administrative controls
Clinic and platform administrators manage team access, feature flags, integration connections, and security settings — all changes audited.
Platform compliance & data controls
- Certified platform: VetOS is built on Base44 — a SOC 2 Type II and ISO 27001 certified platform.
- GDPR & DPA: GDPR-compliant by design; a Data Processing Agreement is available on request.
- Data residency: US by default, with EU/UK storage available on Elite and Enterprise plans.