Connect
PetConnect
Cortex
A veterinary clinic should evaluate cloud security through evidence: who can access records, how access is removed, how data can be restored and who responds to incidents. The word “cloud” and a security badge do not answer those questions on their own.
Use the following checklist when comparing providers. It is a procurement aid, not a statement that a particular product holds a certification or guarantees a recovery time.
Start with access and ownership#
List the systems used by reception, clinicians, managers and external contractors. Ask whether each staff member can have an individual account, what permissions can be assigned and how a departing team member’s access is revoked. Identify who owns the administrative account and who can recover access if that person is unavailable.
NIST recommends enabling multi-factor authentication on accounts that offer it. During a demonstration, ask the provider to show the actual sign-in and recovery options available to your clinic rather than relying on a roadmap slide.
Ask what a backup can restore#
“Backed up” is incomplete without a restore process. Ask which records and attachments are included, how frequently backups are taken, how long they are retained and when restoration was last tested. Clarify how much recent work could be lost and who authorizes a recovery. NIST’s small-business information security guidance treats backups and protection of business information as operational responsibilities.
A downloadable export serves a different purpose from recovery of a production service. Request a sample export and check whether it includes the identifiers and attachments needed to interpret the records outside the application.
Separate marketing statements from evidence#
Provider statement | Evidence to request |
|---|---|
“Encrypted” | Which data paths and storage systems are covered; who manages keys |
“Certified” | Current certificate, scope, issuing body and covered legal entity |
“Highly available” | Written service terms, exclusions and incident history |
“Your data stays yours” | Contract terms for processing, export, deletion and subprocessors |
“AI is private” | Written data-use, retention and model-provider terms |
A certificate for a hosting provider is not automatically a certificate for the software company. Record what the evidence actually covers and mark unanswered questions as open.
Rehearse a disruption#
Choose a simple scenario: internet access fails during a clinic session, an account is compromised or an attachment is missing. Ask staff to explain how they continue safely, contact support and reconcile temporary records later. Record the responsible person and the communication route.
Review this plan when the provider, team or workflow changes. Security is not finished at contract signature, and a clinic should avoid storing its only emergency contact information inside the system it may need to recover.
Pair this checklist with our data protection guide and software selection guide. For a Vetigen evaluation, bring these questions to the contact team and request evidence relevant to your deployment.
