Brute-force lockout
5 failed login attempts within 15 minutes auto-locks the account. Every attempt is recorded with IP + timestamp. Repeat offenders trigger an instant WhatsApp alert to the lab admin.
Cases · invoices · prepaid credits · payroll · sales pipeline · 10-year warranty PDFs. One platform. White-labeled to your lab. Request a demo — we’ll show you the platform live and onboard you when you’re ready.
Your own subdomain. Your logo. Your brand colour. Toothmatrix re-skins itself the moment you sign up — and your patients never see the word "Toothmatrix."
Book a personalised demo. We’ll show you the platform on your real workflows.
Eight modules, one login. Every workflow your team uses today, faster and more reliable.
KPIs, late-case chips, technician workload, Kanban board with WIP limits, auto-balance day.
Submission to delivery, with chat, drawings, 3D STL viewer, status timeline, and activity feed.
Stripe payments, prepaid credit float, auto-top-up via SetupIntent, automatic settlement on accepted cases.
Branded warranty cards generated on every delivered case, QR-verifiable, signed with your logo.
Expenses, employees, monthly runs, payslip PDFs, bank-export CSV, year-end Form 16.
Lead → demo → trial → active, drag-and-drop Kanban, activity logging, target tracking with auto-incentives.
Toothmatrix is built from day one for clinical-grade data handling. Every layer — from password storage to network transport to per-tenant database isolation — uses what hospitals and banks actually deploy in production, not what looks good on a slide.
5 failed login attempts within 15 minutes auto-locks the account. Every attempt is recorded with IP + timestamp. Repeat offenders trigger an instant WhatsApp alert to the lab admin.
Passwords are never stored. We hash with bcrypt (cost factor 12) so even a stolen database is useless — cracking a single password takes years on modern GPUs.
Auth tokens live in SameSite httpOnly cookies — invisible to JavaScript, immune to XSS-based token theft. Signed JWTs with HS256 rotation on every session.
Every query is scoped by tenant_id at the database layer. One clinic can never see another clinic's cases, patients, invoices, or staff — enforced server-side, not client-side.
MongoDB Atlas encrypts every byte on disk with AES-256. Every API call is TLS 1.3-encrypted between the clinic's browser and our servers. No clinical data ever travels in the clear.
Every login, every status change, every invoice edit, every credit movement — append-only, timestamped, attributed. The PDPPL data-subject right of audit is one query away.
Automated nightly snapshots with 30-day retention. Point-in-time recovery via the Disaster Recovery admin tab. Restore individual collections without taking the live system offline.
Sliding-window IP rate limits on signup, case verification, and password reset. Abuse triggers an instant WhatsApp alert so the merchant has off-platform breadcrumbs of attacks.
Every consent ever given — by patients on a case form, by tenants at signup — is logged with IP, version, and timestamp. Withdraw consent and the record is preserved forever for the audit trail.
Mandatory consent gates on every signup and case submission. Patient consent inventory accessible to every tenant admin. A live "Bill of Rights" the data subject (your patient) can read in their language. Immutable audit trail of every personal-data action — required by Article 16 of PDPPL.
Born from a working Qatar dental lab and engineered to the standards required by Qatar's Personal Data Privacy Protection Law — then extended to handle the compliance, currencies, and time zones of clinics from Riyadh to London to New York.
Each region's data-protection law is mapped explicitly to the platform's actual controls.
QAR · AED · SAR · USD · EUR · GBP · INR · KWD · BHD · OMR. Invoices render in the clinic's local currency; FX is locked at invoice date.
English + Arabic out of the box, with right-to-left layout. Patient consent text and warranty PDFs auto-translate per clinic.
MongoDB Atlas regions in Doha, Frankfurt, Mumbai, and Virginia. Clinic data stays in its home region — required by KSA PDPL and UAE PDPL.
Scroll. Each chapter swaps the screen on the right. Or jump straight to a chapter with the buttons below.
Live KPIs · late-case chips · technician workload · drill-down drawers on every tile. Auto-balance the day with one click when a tech goes overloaded.
Six columns from Received → Delivered. Drag a card across columns to advance status. Amber chips warn when a column hits the WIP limit you set in Settings.
Chat with the dentist · attach drawings · view the 3D STL · and below it all, a Salesforce-style activity timeline that's the canonical audit trail.
Every case auto-generates an invoice. Stripe-paid invoices clear instantly. Prepaid-credit clinics settle automatically the moment a case is accepted.
Expenses · employees · monthly payroll runs · branded payslip PDFs · bank-export CSVs · year-end Form 16 + salary register. All in one tab.
Six built-in roles · every permission a checkbox · 'View-as' preview to see exactly what each role gets before you assign them.
SMTP · Twilio + CallMeBot WhatsApp · Stripe + Razorpay · Currency · GST · Kanban WIP limit · scheduled jobs · daily snapshots. All here.
Clinics top up via Stripe. Cases auto-settle from their credit float on acceptance. Set thresholds for off-session auto-top-up, eliminate AR follow-ups.
All plans include every feature. Longer commitments save you more. Cancel any time before renewal.
Listed in QAR . Book a demo to see the platform live before you commit to a plan.
Submit your details on the contact form (or click 'Request a demo'). One of our team replies within one business day to schedule a 30-minute walkthrough on your real workflows. After the demo, you pick a plan and we onboard your lab on a unique subdomain.
Not to see the demo or to scope the deployment. Payment is only collected when you decide to go live on a paid plan.
Yes. As the super-admin of your tenant, you can change the logo, the primary brand colour, the company name, the footer address, and the support contact details. The whole platform rebrands instantly.
Your data is yours. Isolated per tenant. Daily Mongo backups. You can export anything to CSV from any tab.
Cancel any time from Settings → Subscription before your renewal date. No refund for unused months, but you keep access until the period ends.
Book a 30-minute demo and we’ll show you the platform on your real workflows. Your own subdomain. Live in under five minutes once you’re ready.