A $420 payment was posted at 2:00 PM. At 2:14 it was gone. The day sheet still balances, because the deposit was adjusted to match. Nobody did anything wrong, as far as you know. The point is that you would never have known either way. Protect keeps a private record of that kind of change, with the before and after values, and shows you only the ones worth a human look.
What does the screen show?
Protect is a sidebar group with three pages. Action Center lists findings in three tabs: Act now, This week, Expected. Each card names what changed (Completed payment deleted), the before and after values ($420 posted 2:00 PM, deleted 2:14 PM), who and where when the system records it (front desk, workstation WS-03), the dollars named, and a severity. Repeats of the same rule by the same person on the same day fold into one card marked ×N. Three buttons: Expected (add a note, that finding never raises again), Evidence (the rows behind it), Escalate.
Activity is the full change feed. Coverage lists every check and whether it runs on your system, with the reason when it cannot. An evidence pack exports to PDF, and alert emails go to the owner within minutes.
Why is it not a flood of alerts?
Most audit tools raise an alert on every edit, which means nobody reads them. In an internal audit in October 2026 we replayed about 1.4 million real change events from three practices through the old rules and the calibrated ones. The old rules raised 5,959 alerts. The calibrated rules raised 15. This is an anonymised example from our own audit, not an industry figure. The rules that made the difference are plain: a first fill is not a change, a date is not a time, five edits an hour is ordinary front desk work, and one event raises one alert.
What does it read from my practice software?
Read-only, always. On Open Dental: securitylog (the permission type, user, time, patient number, record key and workstation name), userod for names, histappointment for appointment history with the acting user, deletedobject for deletions, and procedurelog for the before and after of a procedure edit. The free-text column of securitylog is never selected. The only things worked out from it are whether a sign-in row is a log-on, whether an edit entry is a deletion, and the dollar amounts in a write-off entry, all computed inside MySQL so the text never leaves your server.
On Dentrix: admin.appthist for appointment history, admin.payment_view and admin.adjustment_view by snapshot comparison, admin.fullproclog, and admin.clinicalnote dates only. The admin.rsc password column is never selected.
On Eaglesoft: transactions_header, where a void is a status flag rather than a delete, and the audit tables appointment_audit, patient_audit and transactions_header_audit only when pe_audit_preference.audit_on is switched on.
If the agent goes silent for 45 minutes during office hours, you get an email. Silence is the tamper signal.
Is it live on my system?
LIVE on Open Dental, Dentrix and Eaglesoft. Each runs a different share of the checks, and the Coverage page says which, with the reason for every limited one.
What it does not do
It does not write to your ledger. It does not prove intent. It never counts a shared login as a person. It does not review coding; that is Revenue Integrity.
Next step
Read the Coverage page for your system before a demo. The Open Dental audit trail guide explains the security log Protect reads, and deleted payments shows how each system records a deletion. The Front Desk and End of Day page covers the daily close.