Security
Clinic data, handled properly
What happens to your scans, your patients' names and your team's access. Described precisely, so you can hold it against your own policy.
Sessions that expire
Signing in issues a short-lived token held in memory and a refresh token in an HTTP-only cookie. Closing the tab does not leave a session lying around in storage.
Passwords are never stored
Only a bcrypt hash at cost 12 is kept, and it is excluded from every query by default, so it cannot leave the database by accident.
Hardened responses
HSTS, nosniff, frame-deny, a strict referrer policy and a locked-down permissions policy. Case ids and patient names appear in URLs, so no referrer is ever sent.
Roles and invitations
Owner, admin and member, per workspace. People join by invitation; nobody signs themselves up into your clinic.
Rate-limited sign-in
Authentication is limited per account and per address, so a leaked password list cannot be walked through the login form.
An audit log
Administrative actions are recorded — who did what, in which workspace, when. Support access to a workspace is recorded the same way.
Hosting
Where your data lives
NexorCAD, its database and every scan you upload are hosted in Québec, Canada, on Nexor Dental's own servers.
Québec, Canada
Who else handles part of it
- An encrypted off-site backup store, in Canada
- The transactional email provider that delivers invitations, password resets and notifications
- Stripe, which takes card payments
Each is bound to use what it receives only to provide that service. The email provider and Stripe never receive your scans or your designs.
Cases you delete are purged within 30 days.
The privacy policy, in full →Regulatory status
NexorCAD is design software. The clinician decides the appliance is indicated, reviews the design and remains responsible for what is made and fitted. If you need a statement about a particular regulatory regime in your jurisdiction, ask and we will answer in writing rather than in a marketing claim.
Design one and time it yourself
Fourteen days and three exports, free, on your own cases — and the sample case that comes with every new workspace never counts.
No credit card. Setting up takes about two minutes.