Every device current. No server that can read a word.
SideClick's sync keeps the clinic room, the front desk and your laptop on the same records through a sync server that stores only ciphertext. This page is the canonical account of how the zero-knowledge design works.
- Included in
- Every edition
- The server stores
- Ciphertext only
- Devices per seat
- Five, three of them computers
- Offline
- Full function; sync catches up
What zero-knowledge sync means
When two of your devices sync, changes travel through our sync server. In SideClick those changes are encrypted before they leave the device, with keys that exist only on devices the practice has signed in and in sealed copies for the people you work with. The server stores and forwards sealed envelopes; it has no key, no plaintext copy, and no way to manufacture either.
This is a structural property, not a policy promise. The operator cannot read patient data, and neither can anyone who breaches, buys or subpoenas the server — there is nothing readable to hand over. When a vendor says "we take privacy seriously", ask them the sharper question: can your servers read my records? SideClick's answer is no, mechanically.
Simultaneous work that converges
Sync is built on CRDTs, data structures designed to merge concurrent changes deterministically. Two clinicians updating the same record on different machines converge to the same result on both, without a server adjudicating. The rare genuine conflict — two people editing the same field in opposite directions — is surfaced to a human to resolve rather than silently overwritten.
Devices you trust, explicitly
Every syncing device is signed in deliberately and approved from another of the person's devices, and any of them can be removed or marked lost. A seat includes five devices, three of them computers: typically the clinic desktop, a laptop, a phone running the mobile app and a tablet, with one to spare.
The threat model for a lost laptop is worth spelling out. Its local database is encrypted at rest, so possession does not equal disclosure; and marking the device lost, from any of your other devices, ends its access immediately. Losing hardware becomes an inconvenience with a checklist, not a notifiable breach by default.
How it works in practice
You see a patient in the clinic and sign the note at the desktop. Driving home, the front desk reschedules tomorrow's first appointment. That evening your laptop opens with both changes already merged and waiting. Nobody exported anything, nobody emailed a database file, and the sync server in the middle carried only ciphertext it could not read.
Offline first, backup included
Every device works fully offline and queues its changes; reconnection merges the queue. Every entry also reaches the sync server sealed — an off-site copy that adds recoverability without adding a readable copy anywhere. Local .cfbak backups remain available in every edition.
Editions
Sync ships in every edition, Solo included: every seat covers five devices, and the sealed copy on the sync server, with its storage, is part of every subscription. The pricing page shows the ladder, including exactly what pauses when a seat ends (existing data never locks).
Questions, answered
Does SideClick work offline?
Fully. The application is local-first: every device keeps working with no connection, and sync merges the queued changes when connectivity returns.
What can the operator of the sync server see?
Sealed entries and delivery metadata — which sign-in sent each sealed entry, when, and which sealed file it belongs to; never the patient's name or what the entry says. Decryption keys exist only on devices the practice has signed in and in sealed copies for the people you work with.
What happens if two clinicians edit the same record at once?
The changes merge deterministically on both machines (CRDTs). A true conflict on the same field is shown to a clinician to resolve; nothing is silently overwritten.
What if a synced device is lost or stolen?
Mark it lost, from any of your devices: its access ends immediately, your other devices are signed out, and its local database was encrypted at rest all along. Removing a device or marking it lost is its owner's own action, no support ticket required.
What happens to sync when my seat ends?
Sending new entries pauses; the sealed copy on the server stays readable for 90 days — sign in, read, export — and a renewed seat resumes service in place. After the 90 days the server copy is deleted; your devices keep everything. The degradation matrix on the pricing page is the complete answer.
Try SideClick free for 30 days
Full capability, no card required. Your data is sealed on our server and we cannot read it.