Your patients told you things they have not told their families. Under POPIA you are the responsible party for that information and we are your operator — so this page describes what we actually do, in plain language, including the parts that are still maturing.
In a multi-practice system this is the thing that matters most, and it is the thing most easily got wrong. Tabs enforces separation in the database itself rather than in the screens, so a mistake in the application cannot expose another practice's patients.
All 87 tables that hold practice data carry database-level access rules. Every query is filtered by the practice you belong to before a single row is returned.
A tenant-isolation test suite runs the exact queries an attacker would — asking for another practice's patients, invoices and notes — and requires every one of them to come back empty.
Six roles as a starting point and six permissions you set individually: clinical viewing, clinical editing, finance, staff, settings and reports. Reception can take money without reading notes.
Psychology session notes are visible only to the treating practitioner unless someone with staff-management rights explicitly grants access — owners do not get it automatically.
Signing a note records a cryptographic fingerprint of its contents. It cannot be silently edited afterwards; corrections are dated, signed addenda that leave the original intact.
96 distinct kinds of action — signing a note, issuing an invoice, refunding, changing bank details, granting access — are written to an append-only log with the person and the time.
Traffic is encrypted in transit and the database is encrypted at rest on managed infrastructure. Identity and passport numbers get an additional layer of field-level encryption on top of that.
A patient proves who they are with a six-digit code emailed to the address on their record. It expires after 15 minutes and allows five attempts before it is void.
Files live in private storage. Viewing one produces a link that works for five minutes and then stops working, so a copied URL does not become a permanent back door.
Tabs never stores card numbers — card data goes straight to Paystack, a licensed provider. We keep only the last four digits for display. Your practice's full bank account number is passed to Paystack and never stored by us.
The database is backed up daily with seven days of retention, so at most about a day's work is ever at risk. We also take verified exports with integrity checks. A full timed restore drill is on our list before we publish a recovery-time promise.
Clinical photographs cannot be uploaded without confirming consent, and that confirmation is stored against each individual image rather than assumed once.
You can export a patient's record for a POPIA access request, and export your practice's data whenever you want it. Your information is not held hostage to a subscription.
There is a documented threat assessment, incident-response runbooks and a backup and restore policy — available to review as part of your operator due diligence.
When something breaks we receive the technical fault, not your patients. Application logs are written to exclude clinical content and personal identifiers.
Tabs runs on managed PostgreSQL infrastructure, with clinical files in the private storage described above. Because data residency matters under POPIA — particularly for cross-border transfers — we state the hosting region and the full list of sub-processors in writing in the operator agreement, before you sign. Ask us for it at the demo.
Any vendor claiming perfection is either lying or has not looked properly. Tabs is a young product and here is an honest account of what is not finished, so you can weigh it yourself rather than discover it later.
Ask us for the threat assessment, the backup policy and the operator agreement. We would rather you read them than take our word for it.