Trust starts with clear boundaries.
Cloud Dental Office is source-available practice infrastructure, not a certification claim. This page states what is in the repository, what IntakeService cannot do, and what we do not put on a badge.
What is public, what is configurable, what is not claimed.
Public & implemented
Intake isolation
API key compared in constant time. Rate limit 5/min per IP. Isolated inbox. BookingRequestedEvent over Service Bus. Token revalidation with 409 on stale slots.
Reference architecture
Private network for PHI
Portal, YARP, and every PHI-bearing service stay private. Only IntakeService is designed to face the internet.
Not currently claimed
Aurelianware certifications
This site does not claim that Aurelianware or Cloud Dental Office currently holds SOC 2 Type II or HITRUST certification.
Pilot · October 2026
Zocdoc
Built on Zocdoc’s scheduling API. Zocdoc has agreed to a pilot starting in October 2026.
Contractual
BAA, SLA, support
PHI processing, support coverage, and incident terms are defined per engagement. Visitor-submitted intake data must still be handled as sensitive healthcare information.
Customer-operated
Production effectiveness
Identity, networks, keys, logging, and recovery must be verified in the target environment. A repository is not a production control.
What IntakeService is allowed to do.
| Action | Allowed | Notes |
|---|---|---|
| Accept name, phone, optional email, preferredStart | Yes | Minimum necessary for appointment intake. |
| Publish BookingRequestedEvent | Yes | 202 only after the event is on the bus. |
| Expose free/bookable slots + availabilityToken | Yes | Slugs, practice timezone, no PHI. |
| Read patient / clinical / scheduling databases | No | No connection. Isolated inbox only. |
| Write an Appointment | No | Staff create the appointment after review. |
| Return 202 when Service Bus is down | No | Returns 503 so the website can fall back. |
Report privately. Do not file PHI in public issues.
Do not disclose suspected vulnerabilities, PHI, credentials, or tenant data through public GitHub issues. Email [email protected] with the component, steps, and redacted evidence. The product SECURITY.md is in the repository.
Source-available under BSL 1.1. Free to run your own practice.
Cloud Dental Office is licensed under the Business Source License 1.1, the same license as Cloud Health Office. You can read, copy, modify, and redistribute the code, and use it outside production.
Production use is free for your own dental practice, or practices under common ownership, including self-hosted. Offering Cloud Dental Office or a derivative to third parties as a hosted, managed, or embedded product that competes with Aurelianware's paid versions requires a commercial license.
Each version converts to Apache 2.0 four years after its first public release. Code at or before the apache-2.0-final tag remains under Apache 2.0.
This is a summary. The LICENSE file is the governing text; LICENSING.md explains it. Commercial licensing: [email protected].
Bring the architecture team. We will walk the isolation boundary in source.
No badges we have not earned.