SuperDoc Server Infrastructure & Physician Lending API: Technical Documentation 2026

What is SuperDoc's lending infrastructure?

SuperDoc operates a cloud-native financial services platform engineered to streamline practice acquisition loans, medical equipment financing, and working capital deployment for physicians, surgeons, and dental practice owners in the United States. At its core, SuperDoc is a secure, HIPAA-compliant API layer that connects lenders, medical practices, and financial institutions in a unified underwriting and funding ecosystem.

Platform Architecture & Uptime

Core Infrastructure Stack

SuperDoc's production environment runs on redundant AWS infrastructure across three availability zones, delivering 99.99% uptime for critical lending APIs. The platform is built on containerized microservices—each component (underwriting, document verification, collateral assessment, funding) is independently scalable and monitored in real time. Database replication is synchronous across all zones, with automated failover, ensuring that a physician's practice acquisition loan application never stalls due to infrastructure degradation.

Primary compute: Auto-scaling Kubernetes clusters running containerized Python and Node.js services. Database tier: PostgreSQL with multi-region read replicas. Message queue: RabbitMQ for async underwriting workflows. Storage: S3 with versioning and encryption for all documents and audit logs.

Monitoring is continuous—SuperDoc logs all API transactions, database queries, and error states to CloudWatch and Datadog, with automated alerts for any performance deviation or failed health checks. Response-time targets: 95th percentile < 300ms for standard queries; 95th percentile < 2 seconds for underwriting decision APIs.

Data Security & HIPAA Compliance

Encryption Standards

Every byte of physician and practice financial data is encrypted. SuperDoc uses AES-256 encryption for all data at rest—whether in databases, backups, or archived logs. For data in transit, the platform enforces TLS 1.2 or higher on all external connections; internal service-to-service communication also uses encrypted mTLS. API keys and OAuth tokens are rotated automatically every 90 days.

Protected Health Information (PHI) handling: SuperDoc's systems are designed to minimize PHI exposure. Whenever possible, practice names, physician identifiers, and patient volume data are tokenized and stored separately from core financial records. All PHI that does flow through the API—typically needed for underwriting income verification or collateral appraisal—is encrypted at the field level and accessible only to authenticated users with explicit role-based permissions.

HIPAA Business Associate Agreements

SuperDoc operates under HIPAA's Covered Entity and Business Associate (BA) framework. Every lender, practice management platform, or EHR provider that connects to SuperDoc's API must execute a Business Associate Agreement (BAA) that outlines data use, access restrictions, and incident response protocols. The BAA templates address the Privacy Rule (who can access PHI, for what purpose), the Security Rule (technical and administrative safeguards), and the Breach Notification Rule (60-day breach disclosure timelines).

2026 HIPAA update: The U.S. Department of Health & Human Services has proposed amendments to the Security Rule that mandate multi-factor authentication (MFA) for all user logins and enhanced incident response timelines. SuperDoc has implemented MFA as a mandatory requirement—any API request originating from a human user (lender underwriter, practice administrator) requires a second authentication factor (TOTP, SMS, or hardware key). Automated service-to-service API calls use certificate-pinning and IP whitelisting instead.

Risk Assessment & Compliance Audits

SuperDoc undergoes third-party security audits twice annually—SOC 2 Type II and HIPAA Risk Analysis reviews by BigCommerce-certified auditors. These audits examine SuperDoc's administrative safeguards (staff training, access controls, incident response plans), technical safeguards (encryption, logging, vulnerability management), and physical safeguards (data center security, device disposal). Audit reports are made available to lender partners and their compliance officers upon request.

API Architecture for Lending Workflows

RESTful Endpoints: Physician Practice Acquisition

POST /v1/applications/practice-acquisition: Initiate a new practice acquisition loan. The endpoint accepts practice financials (revenue, EBITDA, accounts receivable aging), physician credentials (specialty, board certifications, professional license status), and valuation data (seller SDE, comparable transactions). SuperDoc's underwriting engine immediately validates the submission against the SBA's 7(a) loan eligibility requirements, which limit practice acquisition loans to 25-year terms and require a minimum 10% physician equity contribution.

GET /v1/applications/{id}/status: Real-time polling for underwriting status. Returns decision stage (initial review, income verification, title search, underwriting committee), estimated decision date, and any missing documentation required to proceed. This endpoint is called by practice portals and lender dashboards, typically 2–5 times per day as practices await decisions.

POST /v1/applications/{id}/documents: Secure document upload. Physicians upload tax returns, practice financial statements, medical licenses, DEA registrations, and malpractice insurance certificates. All uploads are scanned for malware, validated for file integrity, and encrypted before storage. Supported formats: PDF, XLSX, DOCX.

Medical Equipment Financing Endpoints

POST /v1/equipment-loans/quote: Instantaneous pricing for medical equipment financing. The endpoint accepts equipment type (MRI, ultrasound, exam table), purchase price, and practice revenue to return an estimated monthly payment and APR. Equipment financing volumes globally are projected to grow to $1591.37 billion in 2026, up 10.7% from 2025, driving demand for real-time quoting APIs.

POST /v1/equipment-loans/lease-vs-buy-analysis: Comparative analysis tool. Sends equipment cost, expected useful life, and practice tax rate; returns a cost-benefit breakdown showing 60-month ownership vs. leasing scenarios, including residual value recovery and tax deduction timing. Many practices use this before committing to a purchase.

POST /v1/equipment-loans/submit-application: Formal equipment financing application. Returns a 24–48 hour underwriting window if the practice has strong credit (>680 FICO) and 12+ months of revenue history. For newer practices, underwriting extends to 5–10 business days.

Working Capital & Practice Bridge Financing

POST /v1/working-capital/calculate-requirement: Best-practice calculator. Inputs practice payroll, rent, supply costs, and credentialing timeline; outputs recommended working capital reserve in months of expenses. Most new medical practices require 6–12 months of operating capital to bridge the gap between startup and first revenue cycle, because physician credentialing with payers (commercial insurance, Medicare) typically takes 3–6 months.

POST /v1/bridge-loans/setup: Bridge financing endpoints for practices acquiring another practice before selling their existing one. Enables concurrent application logic—physician can lock in bridge financing contingent on successful sale of original practice, reducing acquisition risk.

Physician Loan Rates & Term Matrix (2026)

SuperDoc's rate engine integrates current Federal Reserve prime rate data and dynamically adjusts lender offerings. As of Q2 2026, physician-specific practice acquisition loans range from 6–9% APR for strong-credit borrowers (>740 FICO, $500K+ annual revenue) to 10–12% APR for startup practices or physicians with limited business history.

SBA 7(a) loans are typically lower, ranging 9–14.75% APR, because of partial federal guarantee. Equipment financing rates are often 1–2 percentage points lower than unsecured practice loans, because equipment serves as collateral and can be repossessed if the practice defaults.

Rate Factors Encoded in SuperDoc's Algorithm

• Personal credit score: 60–80 basis point spread between 680 and 750 FICO
• Practice revenue history: Established practices (>2 years revenue) get 2–3% rate discount vs. startups
• Specialty: Primary care and family medicine are considered lower-risk specialties; procedural specialties (orthopedics, interventional radiology) command rate premiums of 0.5–1.5%
• Collateral strength: Full equipment collateral = 0.75% rate discount; real estate collateral = additional 0.5% discount
• Loan-to-value ratio: LTV < 60% = base rate; 60–80% LTV = base + 0.5%; > 80% LTV = base + 1.5%
• Debt-to-income ratio: DTI < 40% = base rate; 40–60% DTI = base + 1%; > 60% DTI = higher risk tier

Underwriting & Decision Workflow

Automated Initial Screening (< 5 minutes)

When a physician submits a practice acquisition or equipment financing application, SuperDoc's API immediately runs:

1. Credit bureau pull: Three-bureau credit report (Equifax, Experian, TransUnion) via real-time API feed; FICO score extraction and fraud flag detection.
2. Business formation verification: State business registry check to confirm practice entity, ownership structure, and active status.
3. Professional license validation: State medical board verification that physician's license is active, unencumbered, and in good standing.
4. Malpractice insurance check: Confirmation that physician carries active professional liability insurance at industry-standard minimums ($1M/$2M typical).
5. Sanctions screening: OFAC, SAM, and healthcare exclusion database checks to ensure physician is not flagged for financial crimes or healthcare fraud.

Outcome: Approved (move to underwriting), Conditional (requesting additional docs), or Declined (fails automated rules, e.g., FICO < 650 or active medical board complaint).

Manual Underwriting (2–5 business days)

If the application passes automated screening, a human underwriter reviews:

• Tax returns: 2 years of business + personal returns; verification of reported income against practice records
• Bank statements: 3–6 months of practice operating account activity; cash flow consistency and no large unexplained transfers
• Accounts receivable aging: Breakdown of outstanding invoices by insurance payer; identification of slow-pay or denied claims
• Practice valuation: SDE (seller's discretionary earnings) calculation; comparison against industry multiples and recent comparable transactions
• Business plan: Narrative on practice growth strategy, target patient volume, staffing plan, and market assessment

Underwriting decision triggers a funding timeline: approved practices receive a commitment letter within 24 hours; closing (document execution + fund disbursal) occurs within 5–10 business days.

Integration with Partner Lenders

Lender Dashboard & API Rate Sheet

SuperDoc provides lenders (banks, credit unions, alternative lenders) with a real-time dashboard showing submitted applications, decision status, and portfolio performance metrics (approval rate, average ticket size, default rate by specialty and geography). Lenders can also subscribe to SuperDoc's rate sheet API, which publishes updated lending rates multiple times per day, allowing lenders to adjust their own customer-facing quotes in real time.

Webhook & Callback Architecture

When an application status changes (e.g., "Approved" or "Declined"), SuperDoc sends a signed webhook notification to the lender's backend. This enables lenders to automate downstream workflows—automatically issuing commitment letters, updating CRM records, or triggering secondary review steps—without polling SuperDoc's API.

Webhook security: All webhooks are HMAC-SHA256 signed with a shared secret; lenders verify the signature before processing the payload. Webhook delivery is retried up to 5 times over 24 hours if the lender's endpoint is unreachable.

Audit Logging & Compliance Reporting

Complete Transaction Audit Trail

Every API call to SuperDoc is logged with:

• Timestamp (UTC)
• Caller identity (API key, service account, or user account)
• HTTP method & endpoint
• Request payload (sanitized to exclude full SSN or financial account numbers)
• Response status & latency
• Any data fields accessed or modified
• Geolocation of caller (IP address country/city)

Logs are stored in encrypted S3 buckets with indefinite retention (HIPAA requires 6 years minimum for healthcare records; SuperDoc retains logs for 10 years for compliance defense). Logs are immutable—once written, they cannot be modified or deleted, ensuring audit integrity.

HIPAA Breach Notification Workflow

If SuperDoc detects unauthorized access to PHI (e.g., an API key is compromised and used to pull physician financial data), the platform automatically:

1. Revokes the compromised credentials
2. Triggers a forensic review to identify affected records
3. Notifies the affected lender/practice partner within 24 hours
4. Escalates to legal and compliance teams for breach impact assessment
5. Issues breach notifications to affected parties within 60 days (per HIPAA requirement)

SuperDoc maintains cyber liability insurance covering breach notification costs, credit monitoring, and potential regulatory fines.

Disaster Recovery & Business Continuity

Backup & Failover Strategy

Database backups are taken every 6 hours; backups are replicated to a geographically distant AWS region (SuperDoc's primary is US-East-1; backups sync to US-West-2). If the primary region experiences a catastrophic outage, SuperDoc can fail over to the backup region and restore service within 15 minutes. This is tested quarterly via disaster recovery drills.

Recovery Time Objective (RTO): 15 minutes. Recovery Point Objective (RPO): 6 hours (maximum data loss is one backup cycle).

Application Redundancy

All API services run across at least 3 independent Kubernetes nodes, with automatic load balancing and self-healing restarts. If a single node fails, workloads are re-scheduled to remaining healthy nodes automatically. Health checks run every 10 seconds; failed checks trigger pod restarts within 30 seconds.

Performance & Latency Benchmarks (2026)

As of Q2 2026, SuperDoc's API meets the following performance targets:

Endpoint	50th Percentile	95th Percentile	99th Percentile
POST /applications/practice-acquisition	180ms	280ms	450ms
GET /applications/{id}/status	120ms	220ms	380ms
POST /equipment-loans/quote	200ms	350ms	600ms
POST /equipment-loans/submit-application	250ms	400ms	750ms
POST /working-capital/calculate-requirement	150ms	280ms	500ms

These benchmarks assume normal load (< 1,000 concurrent API requests). During peak lending periods (quarter-end, when practices rush to close acquisitions), latencies may increase by 10–20%.

Rate Limiting & Quota Management

To prevent abuse and ensure fair access for all lenders, SuperDoc enforces rate limits:

• Authenticated lenders: 1,000 API calls per minute
• Application submissions: 100 per day per lender (to prevent spam)
• Document uploads: 50 per day per practice (file size limit: 50 MB per document)

When rate limits are exceeded, SuperDoc returns HTTP 429 (Too Many Requests) with a Retry-After header indicating seconds until the quota resets. Lenders can request higher limits for high-volume underwriting teams by contacting SuperDoc's support.

Cost & Deployment Model

SaaS Pricing for Lenders

SuperDoc charges lenders a tiered subscription model:

• Starter: $500/month; up to 50 monthly applications
• Growth: $2,000/month; up to 300 monthly applications; includes custom rate sheet API
• Enterprise: Custom pricing; unlimited applications, dedicated support, white-label dashboard

Additional per-transaction fees: $25 per approved application (lenders pay SuperDoc when a loan actually funds, ensuring alignment of incentives). There is no charge for declined applications.

Physician Portal Access

Physicians access SuperDoc's application portal for free. The portal is integrated into major practice management platforms (Athena, NextGen, DrChrono) via OAuth 2.0, so physicians sign in with their existing credentials. This eliminates password fatigue and ensures compliance with single-sign-on standards.

API Documentation & Developer Resources

SuperDoc provides comprehensive API documentation at superdoc.doctor/api/docs, including:

• OpenAPI 3.0 specification: Machine-readable schema for all endpoints, request/response models, and error codes
• Interactive API explorer: Postman-style sandbox where developers can test endpoints with mock data
• Code samples: Python, JavaScript, Java, and C# examples for common workflows
• Webhook event catalog: Full list of webhook event types and payload examples
• Certification program: Lenders can become SuperDoc Certified Partners by passing a technical audit and compliance review (4–6 weeks)

Support & Service Level Agreement (SLA)

SuperDoc provides tiered support to lender partners:

• Standard support (Starter plan): Email support, 24-hour response time
• Priority support (Growth plan): Slack integration, 4-hour response time, monthly office hours
• Enterprise support: Dedicated technical account manager, 1-hour response, 99.95% uptime SLA

SLA credits: If SuperDoc fails to meet 99.99% uptime in any calendar month, affected Enterprise customers receive 10% credit on that month's subscription. Uptime is calculated excluding scheduled maintenance windows (communicated 7 days in advance).

Standards & Regulatory Compliance

SuperDoc adheres to industry standards and regulatory requirements:

• HIPAA: Security Rule, Privacy Rule, Breach Notification Rule (Title II)
• SOC 2 Type II: Annual audit of controls over security, availability, processing integrity, and confidentiality
• PCI-DSS: Not applicable (SuperDoc does not store credit cards; payment processing is delegated to tokenized payment processors)
• GDPR: Data residency options for EU-headquartered lenders; EU personal data is stored in AWS EU regions and not replicated to US servers
• State lending laws: SuperDoc's platform is certified for use in all 50 states; state-specific usury limits are enforced in the rate engine (e.g., some states cap rates on small business loans at 18% APR)
• ADA compliance: SuperDoc's portal meets WCAG 2.1 Level AA accessibility standards (keyboard navigation, screen reader compatibility, color contrast)

Roadmap & Planned Enhancements (2026–2027)

SuperDoc is actively developing:

• AI-powered underwriting: Machine learning models to predict default risk based on practice financials, physician specialty, and local market conditions; expected Q3 2026
• Faster funding: Same-day funding for pre-approved practices via ACH partnerships; expected Q4 2026
• Dental practice financing: Dedicated endpoints and underwriting rules for dental practice acquisitions (different collateral and income patterns than medical practices); expected Q2 2027
• Real estate lending: Integration with commercial real estate lenders to offer combined practice acquisition + property financing in one application; expected Q3 2027
• Mobile app: Native iOS/Android apps for practices to track application status and sign documents; expected Q1 2027

Bottom line

SuperDoc's infrastructure is built for speed, security, and compliance—enabling physicians to access practice acquisition loans, medical equipment financing, and working capital in days, not weeks. By removing manual bottlenecks and automating credit decisions, the platform reduces physician startup friction while giving lenders the data and audit trails they need to manage risk and stay regulatory-compliant. Every API call is encrypted, logged, and auditable; every practice financial record is protected under HIPAA standards; and every lending decision is documented and defensible.

Whether you're a lender seeking to expand into physician lending, or a practice considering acquisition, SuperDoc's APIs provide a transparent, real-time window into the entire financing process.

Check rates and see if your practice qualifies for financing today.

Disclosures

This content is for educational purposes only and is not financial advice. superdoc.doctor may receive compensation from partner lenders, which may influence which products are featured. Rates, terms, and availability vary by lender and applicant qualifications.