Enterprise Security Architecture

Accord Dental processes protected health information for multiple practices, so security isn't a feature bolted on at the edges — it's a property of the architecture. This document describes how access is controlled, how tenants are isolated, how secrets are handled, and how the pipeline is designed to minimize exposure.

Tenant isolation, enforced at the database

The foundation of Accord's security model is that one practice can never see another's data — and that guarantee is enforced beneath the application, in the database itself. Accord uses PostgreSQL row-level security (RLS) in FORCE mode, scoped by tenant. Every domain table carries a tenant identifier, and the application connects as a non-owner role that cannot bypass RLS.

The practical consequence: a query that arrives without the correct tenant context returns zero rows, not another tenant's data. Isolation doesn't depend on the application remembering to add a WHERE tenant = … filter — the database refuses to return cross-tenant rows regardless of what the application asks for. A logic bug in application code therefore cannot leak data across tenants.

Least-privilege access

Access follows least-privilege boundaries. The application runs under a role scoped to routine data operations and cannot alter schema; structural changes require a separate administrative role. Splitting these roles means the credential the running service holds is not powerful enough to reshape or drop data — it can only do the constrained work the application needs.

Secrets are never in the codebase

Sensitive credentials — including the database password — are stored in AWS SSM Parameter Store and read at runtime, not committed to source control or baked into configuration files. Secrets can be rotated without a code change, and the repository never contains a live credential. Provisioning is guarded so that critical parameters (like the database password the RDS instance was created from) can't be silently overwritten.

Data minimization across the pipeline

Security also means handling less sensitive data in the first place. Accord's extraction pipeline is deterministic-first: structured extractors process clinical documents directly, and only low-confidence documents are escalated to an AI extraction step. The effect is that the majority of PHI is handled by deterministic code and never reaches a general-purpose language model — the AI surface sees only the cases that genuinely require it. Minimizing what flows to a probabilistic component is a security decision as much as an accuracy one.

Transport and storage

Traffic to Accord is served over HTTPS/TLS. Data at rest lives in managed AWS services (RDS and S3).

Traceability as a security property

Because every stored value in Accord is traceable to its source and no data is invented, the system's reasoning can be reconstructed after the fact. That reconstructability is a security and integrity property: it means a determination can be reviewed and explained rather than trusted blindly, and it makes unexpected changes to data visible against the sourced record.

What this covers

This architecture addresses the technical dimension of security: isolation, least-privilege access, secrets handling, data minimization, transport security, and traceability. It is one part of a broader security and compliance program — administrative and physical safeguards, monitoring, incident response, and any required agreements between a practice and its vendors sit alongside it and are the responsibility of the organizations involved.