Overview
This article describes the security controls of Dermi Atlas Professional for IT administrators, practice managers, and privacy officers: where data is kept, exactly what is sent to Dermi, how connections and accounts are protected, and which safeguards the practice configures itself.
Local Data Custody
Dermi Atlas Professional runs on a computer the practice owns, on the practice network.
- Local storage: Patient records, clinical photographs, clinical notes, consent records, account password hashes, and the audit log are stored on the host computer.
- No cloud copy: Patient data is never sent to Dermi.
- No remote access path: The software gives Dermi no remote access to the deployment or its data. Assisted setup, which is a remote session, and data import assistance are provided on a deployment that remains under the practice's control, as set out in the Dermi Atlas Assisted Services Terms.
What Reaches Dermi
The items below are the complete set of data the on-premises software sends to Dermi. None of them includes patient records, clinical photographs, clinical notes, or the audit log.
- License activation: The license key, the installation identifier, the device fingerprint, the name of the host computer, and the acceptance of the End User License Agreement.
- License agreement: Installing Atlas, updating it, or restoring a backup from the installer also records the acceptance of the End User License Agreement with the installation identifier and the device fingerprint.
- License check: Atlas checks its license with Dermi at regular intervals. Each check carries the license and installation identifiers, a device fingerprint identifying the host computer, the team identifier, the version of the member list the deployment has applied, and the running Atlas version.
- Deployment Statistics: Each license check also carries aggregate totals for the deployment: the number of patients, images, tags, and team member accounts, and the total image storage size. Deployment Statistics is on by default and is turned off with the Deployment Statistics toggle in the Settings group of the Administration area in Dermi Atlas Manager, after which the check carries the Atlas version without the totals.
- Installation report: Dermi Atlas Manager reports when it starts and after it installs, updates, restores, or removes Atlas. The report carries the installation identifier, the device fingerprint, the Atlas and Dermi Atlas Manager versions, the host operating system name and version, the processor architecture, and the Docker version where available.
- Team membership: Dermi Portal holds each member's name, username, email address, account type, and membership status. When a member claims an invitation, the deployment sends the username and display name chosen at the claim. It also reports when an account is deleted on the deployment and when a member completes an email address change or an upgrade to a Clinician account issued from Dermi Portal.
- Account verification emails: Password change and recovery, two-factor authentication, and account deletion links are emailed through Dermi. Each request carries the member's email address, username, and first name, the request type, the link, and the details of the requesting device: its IP address, the IP address of the host computer, the public IP address of the practice network, the browser user agent, and the timezone.
- Sign-in and security notification emails: Sign-in alerts and security-change confirmations (password, two-factor authentication, email address, account details, recovery code use, and account deletion) are emailed through Dermi with the same device details. Each member chooses under Email Notifications on the Account page whether an alert is sent for every sign-in or only for essential security events.
- Update checks: Dermi Atlas Manager downloads release information and update files from Dermi. The requests carry no account or patient data.
- Diagnostics: Diagnostics are sent only when the operator opens Send Diagnostics from the Support drawer of Dermi Atlas Manager and selects Send. The diagnostics hold the Dermi Atlas Manager logs, the recent Atlas logs apart from those of patient record and image storage, the software and operating system versions, the name of the host computer and its system details (hardware and Docker version), the deployment settings without passwords or keys, and any message the operator adds. Patient records and images are never included. A confirmation is emailed to the license owner. The diagnostics are deleted after 90 days and the reference record after 12 months. The notice sent to Dermi support, which names the host computer, its versions, and the license owner's email address and carries any message the operator adds, is kept with the support correspondence.
Separately, when a member creates their account by claiming an invitation, signs in, recovers a password, changes account details or security settings, or deletes their account, the browser looks up the public IP address of the practice network from checkip.amazonaws.com, an Amazon Web Services address, and the address is recorded with the event's audit log entry. Dermi Atlas Manager, every 30 seconds while it is open, and Atlas, when it checks its license, also check for an internet connection by requesting clients3.google.com, a Google address. None of these requests carries account or patient data.
Retention of this data is described in the Dermi Privacy Policy, and the locations where it is processed are listed in the Dermi Sub-Processors document.
Network Security and Encryption
Transport Layer Security (TLS)
Connections on the HTTPS address are encrypted with TLS 1.2 or TLS 1.3.
- HTTPS (port 15045): A device that trusts the Atlas certificate connects without a warning.
- HTTP (port 15015): Unencrypted; HTTPS is recommended wherever the network includes Wi-Fi or is shared.
Self-Signed Certificates
Atlas is reached at a local IP address (for example 192.168.x.x) rather than a public domain, so a public certificate cannot be issued for it.
- Generation: A certificate specific to the host computer is generated when the deployment starts. It is regenerated automatically when it is invalid, within 30 days of its expiry, and when a regeneration has been scheduled from Dermi Atlas Manager.
- Trust: The certificate is installed on each client device so that browsers trust the connection. See SSL Certificate Setup for HTTPS Access.
Firewall Requirements
On Windows, Dermi Atlas Manager creates the required inbound firewall rules for Private and Domain networks automatically, which requires administrator privileges. On a network set to Public, other devices cannot reach Atlas. When every network of the host computer is set to Public and the firewall rules are in place, the Atlas Access card reports Public Network Profile, and the notice clears at the next Atlas start after the network is set to Private. On macOS, no change is needed while Block all incoming connections is off and Docker, if listed, is set to allow incoming connections. On Linux, no host firewall rule is needed, and a host firewall rule does not close the Atlas ports.
- Inbound rules: TCP traffic is allowed on ports 15015 (HTTP), 15045 (HTTPS), 15815 and 15845 (real-time sync), and 15000 (the certificate download for client devices). When a default port is already occupied, Dermi Atlas Manager selects an alternate; the ports in use are listed under Atlas Status => Atlas Access.
- Isolation: The host computer is best run on a private practice network, not a guest network.
See Firewall Configuration for the steps on each operating system.
Access Control and Authentication
The Team Model
A deployment holds exactly one practice team, and every clinical record on it belongs to that team.
- Every member of the team sees every patient, entry, and image on the deployment, which matches how a practice keeps one clinical record per patient.
- Each person signs in with their own account, username, password, and optional two-factor authentication. Under Comprehensive logging, the default, every action is recorded under the person who performed it, and the record stays with the practice after the member leaves.
- The account type sets what a member may do. Export, deletion, recovery, and patient identity edits are Clinician actions; the complete list is in Account Types and Permissions.
- Accounts are created only by claiming an invitation issued from Dermi Portal. Dermi Portal tells the deployment who is on the team and nothing more; it cannot read, change, or create clinical records.
Authentication Standards
- Password storage: Passwords are stored only as salted one-way hashes.
- Complexity: Passwords are 12 to 256 characters long and contain a lowercase letter, an uppercase letter, a number, and a special character.
- Two-factor authentication: Optional and recommended. Codes come from a time-based one-time password (TOTP) authenticator app, and recovery codes are issued when it is turned on. A member can select Trust this device at sign-in, which skips the code on that device for 30 days.
- Sessions: A session ends after seven days without activity and is extended while it is in use; the period is fixed. Each member reviews their devices under Signed-In Devices on the Account page and can sign out one device or all of them with Sign Out Everywhere. Signing a device out also ends its 30-day two-factor trust. Sign Out Everywhere includes the device in use and clears every trusted device.
See Account Security for the member-side steps.
Administration on the Host Computer
The deployment-wide settings, the immediate disabling of an account, and the deployment purge sit in the Administration area of Dermi Atlas Manager, behind an admin passphrase that never leaves the host computer. See Atlas Manager Administration.
Backups
Backups are created, exported, and restored from Backup Management in Dermi Atlas Manager.
- Contents: Backups hold the patient records and images, the audit log, and the deployment settings, including the deployment's keys.
- Incremental: Each backup copies only the images added or changed since the previous one. A deleted record or image remains in every backup that holds it until those backups are deleted in Backup Management, and old backups are not removed automatically.
- Integrity: A backup is verified for integrity before it is restored.
- Location: Backups are kept in a fixed folder inside the Dermi Atlas Manager data folder on the host computer. The same folder holds any safety copy that the installation wizard keeps when it installs or restores over Atlas data left on the computer; a safety copy is not listed as a backup in Backup Management and stays until it is removed from the folder.
- No encryption: Backups and exported copies are not encrypted by the software.
- Export: Export writes a backup to a chosen folder as a single
.tar file.
Custody: Exported copies belong on an encrypted drive or an encrypted storage service the practice has vetted, kept off site and under access control.
The steps are in Backing Up and Restoring Dermi Atlas Professional.
Host System Hardening
Dermi Atlas Professional relies on the security of the host computer, so the practice applies these measures:
- Disk encryption: BitLocker (Windows) or FileVault (macOS) protects data at rest if the computer is stolen.
- Operating system updates: The operating system is kept patched.
- Physical security: Physical access to the host computer is limited to authorized staff.
- Administrator accounts: Administrative control of the host computer is limited to the people responsible for it, since that control reaches past the admin passphrase.
Related Resources
- Security and Compliance Fundamentals for the shared responsibility model
- Audit Logging Configuration for what the audit log records and how it is read
- Atlas Manager Administration for the admin passphrase and the deployment-wide settings
- Firewall Configuration for the port rules on each operating system