Security
Built to protect the data a practice cannot afford to lose
Pay rates, staff records, supplier payments and inspection evidence are sensitive. MyPracti is designed around least access, a complete record of changes, and keeping only what is needed.
Security controls
Two-factor sign-in for everyone
A password alone is never enough. Every account enrols an authenticator app, and replacing one needs the password and a current code.
Permissions checked on every action
Roles such as owner, finance, practice manager, HR and auditor decide what each person can see and change, and the check runs on the server, not just the screen.
Practices kept apart in the database
Row-level security isolates each organisation, and narrows a person to the practices they work in, beneath the application itself.
A full audit trail
Sign-ins, changes to pay terms and exports are recorded with who and when. Auditors can read the log without seeing pay.
Built to minimise patient data
MyPracti does not hold clinical records. Figures drawn from practice systems are stored without patient identities, and documents that may contain patient details are flagged and shared by secure link, never as email attachments.
Retention that actually deletes
Data is kept for defined periods and purged on schedule, with each purge recorded, in line with UK GDPR data minimisation.
Access follows the job
Each person is given a role and, where it applies, a set of practices. The application checks permissions on every action, and the database enforces the same boundaries underneath it.
- Group admin
- Everything in the organisation, including settings and integrations.
- Finance director
- Finance, reconciliation and reporting across the companies they are given.
- Practice manager
- Their own practice: rota, people, compliance and day-to-day operations.
- HR
- Staff records and recruitment checks, without finance.
- Auditor
- Read-only access, including the audit log, without the ability to change anything.
In practice, that means
- Repeated wrong passwords slow down further attempts rather than locking an account, so knowing someone’s email is not enough to keep them out.
- Changing an authenticator needs the password and a current code, and the user is told by email.
- Integration credentials and authenticator secrets are stored encrypted.
- Irreversible actions ask for confirmation and say what they will lock.
- Exports that leave the system, such as payroll hours, carry only what the recipient needs.
- Scheduled jobs that fail raise an alert rather than failing silently.
Security questions and due diligence
We are happy to answer security questionnaires and to discuss hosting, data processing and our approach in detail as part of your evaluation. Email hello@mypracti.com or contact us. Please report any suspected vulnerability to the same address.
See MyPracti with your own practice in mind
A 30-minute walkthrough of the areas you care about, with a member of the team. No obligation and no sales script.