Security
One practice’s recordsstay one practice’s.
PetGrid runs every practice on shared infrastructure. That only works if the wall between them is real, so here is exactly where it is and what holds it up.
How the wall works
Enforced a layer below the application
Application code that forgets to filter by practice is the usual way this goes wrong, so the check does not live in application code.
The database refuses, not the code
Every clinical and billing table carries the practice it belongs to, and Postgres row-level security is enabled and forced on all of them. A query that arrives without a practice context returns nothing. Not a partial result: nothing.
The connection cannot opt out
The role the apps connect as cannot bypass those policies. That is a property of the role itself, so no query written later can opt out of it, deliberately or by mistake.
Writes are checked the same way
A write aimed at another practice is rejected by the policy rather than silently accepted, so a bug cannot quietly file a record under the wrong clinic.
Who gets in
Your practice decides, and the server checks
The other half of the question, and the half where most software says something it cannot back. Here is exactly what PetGrid checks and what it leaves to you.
Staff join by invitation only
Nobody signs up into your practice. A practice admin sends an invitation, and only an invited address can join. There is no open door to walk through.
What each person can open is enforced, not hidden
Admin, veterinarian, vet tech and front desk each open a different set of screens, and every server action checks the role before it does anything. Hiding a menu item is not access control, so PetGrid does not rely on it. A test fails the build if an action forgets to check.
Removing someone actually removes them
Remove someone from your practice and they lose access on their next request, stop counting as a billable seat, and disappear from every list. Their name stays on the entries they wrote, because a record has to say who made it.
Licence numbers are recorded, not verified
PetGrid records a veterinarian's licence number, shows it on the rabies certificates they sign, and does not verify it. It is typed in by that veterinarian, and it is your practice, not PetGrid, that confirms who your veterinarians are. Anyone telling you their software vets your staff is describing something else.
What PetGrid does not hold
The safest data is the kind you never took
Card details
There is no card number, expiry or security code anywhere in the schema. Your subscription is paid through Stripe, which holds the card. If you take card payments from your clients, they go through your practice's own Stripe account: pay links, a card saved on file, refunds and a Stripe card reader, each off until you switch it on. Card details go to Stripe and never reach PetGrid, and PetGrid takes no fee on those payments unless your practice agrees to one in writing.
Your records mixed with others
Records belonging to one practice are never pooled with another practice's, and no other practice can see them.
A front door you do not control
Pet owners join your practice through an invitation your team sends, or through your own join link and QR code if you switch it on. Someone who joins by the link with the email address you already have on file is connected to their existing record. Everyone else waits under "New from the join link" until your team approves, merges or removes them, and you can switch the link off or replace it at any time.
AI
The owner’s switch comes first
PetGrid has AI features now. Each of them is held to the same few rules, and the rules are in the code, not only in a policy.
The owner can say no
Note drafting sees only the vet's own notes and basic pet details, never the owner's name or contact details. History summaries, suggested replies and visit summaries are on for every pet unless its owner opts out, in the client app or by asking the clinic. Each of those features checks before reading that pet's record, and refuses if the owner has opted out.
A person approves what AI writes
Note drafts, history summaries and suggested replies are drafts. A person reads and approves each one before it is saved or sent, and a veterinarian approves any visit summary before the owner sees it.
The receptionist says what it is
The phone receptionist tells a caller it is an AI whenever they ask, and never claims to be a person. It gives no medical advice. An urgent word puts the call through to your team at once, or when you are closed tells the caller to ring the emergency hospital you name, without waiting on the model.
Only what a request needs
The model is run by Anthropic, which receives only what a request needs. A practice can also switch AI features off for the whole clinic in Settings: AI Assist, summaries, AI records import and clinic memory then send nothing to the model.
Where it runs
Encrypted in transit and at rest
PetGrid runs in a secure cloud. Every connection is encrypted, from your browser to PetGrid and from PetGrid to its database, and browsers are told to use nothing but HTTPS. The database is encrypted at rest, and the nightly backup is sealed with AES-256-GCM before it is stored privately, for 35 days. If your practice has rules about where its records are kept, tell us before you start; the privacy policy has the details.
Being straight with you
What we have not done yet
PetGrid is early and has no customers yet. You will hear this from us before you hear it from a security questionnaire.
- No SOC 2 or ISO 27001 audit. Nobody independent has reviewed this yet.
- No log yet of who opened a record. Every change, print, download and export of a record is logged with who did it, but simply opening one is not.
- No customer-managed encryption keys, and no single-tenant database option.
- No formal penetration test.
- No signed DPA or BAA template ready to hand to your lawyer.
- No choice of hosting region yet.
If any of these is the thing standing between you and a trial, say so on the call and we will tell you honestly whether it is weeks away or not on the map.
Ask us the hard ones
Bring your questionnaire to the demo.