Every DSO dental AI deal hits a gate that single-location deals rarely do: the IT review. A DSO IT director, a practice technology lead, or — on the largest deals — a CISO arrives in the buying committee carrying a vendor security questionnaire, a list of integration questions, and the authority to stop a contract that has otherwise passed clinical, operational, and financial review. The pilot scorecard closed last week. The pricing battlecard opens next week. Between them sits the IT due-diligence stage — a stage where Competitor A (the horizontal voice-AI platform) and Competitor B (the dental-pure AI receptionist) attack on completely different vectors and a stage where Voicify deals get lost on questions the AE never saw coming. This is the IT and integration due-diligence battlecard that closes that gap.
TL;DR
Five domains, two attack patterns, one battlecard. A-slot horizontal platforms attack on breadth — more connectors, more carriers, more identity providers — and lose on PMS write-back depth where their general-purpose architecture cannot follow Dentrix or Open Dental into the appointment book. B-slot dental-pure receptionists attack on procurement simplicity extended into the IT layer — no questionnaire, no MSA, no SSO, no SOC 2 — and lose the moment the IT lead asks for any document the Voicify CISO has already pre-staged. The rep hands the IT lead a dental-specific security packet before the questionnaire arrives; the SE joins the next call the moment IT enters the buying committee; the AE never answers an IT question solo and never leaves a written-record gap the competitor can exploit.
Why the IT Battlecard Is Its Own Layer
The IT review is its own deal stage because the buying committee changes. The clinical lead and the practice manager are gone or in observer mode; the IT director or technology lead is now in primary, often with a security officer or external vCISO copied in. Their criteria are not the criteria that won the pilot. They do not care about appointment coverage uptime or after-hours conversion rate; they care about whether your product can be uninstalled cleanly, whether your sub-processor list is current, whether your incident-response procedure has a named primary, and whether your PMS integration writes back to the appointment table in a way their database administrator can audit. The master battlecard does not cover those questions in depth because the master battlecard is written for the deal stage where clinical and operational leaders are in primary. The IT battlecard is the layer below.
It also fires on its own trigger. The trigger map treats "IT or security lead joins the buying committee" as a named signal in its own right — separate from the pricing escalation signal, separate from the new-executive signal — because the artifact, the activation cue, and the role transition are all different. The AE does not own the IT stage. The SE does, with the AE in support and the CISO or head of security on standby for the security packet hand-off. The activation cue is simple: the moment IT joins, the SE is on the next call. No exceptions.
The Five-Domain Due-Diligence Surface
The IT review covers five domains. Each domain has a slot-specific attack pattern from Competitor A or Competitor B, a Voicify response, and the artifact the rep or SE hands the IT lead. The five domains are exhaustive in the sense that questions outside them are extremely rare; they are not exhaustive in the sense that any one domain can sink the deal alone.
| Domain | A-slot attack | B-slot attack | Voicify anchor |
|---|---|---|---|
| PMS integration | Breadth of connectors, generic DB sync | Single-PMS depth, no enterprise PMS support | Write-back depth across Dentrix, Open Dental, Eaglesoft, Dentrix Ascend |
| Security & HIPAA | Platform-level SOC 2, no dental-specific data flow | No SOC 2, BAA on request, vague sub-processor list | Pre-staged dental-specific security packet |
| Telephony & numbers | Broad carrier list, generic SIP | Single-carrier resale, no number porting | Direct PSTN + carrier-agnostic SIP, full port-in and port-out |
| Identity & SSO | Broad IdP support, no role mapping to dental seats | No SSO, single shared login per practice | SAML 2.0 + SCIM, role mapping to front-desk vs ops vs clinical |
| Failover & SLA | Platform-wide SLA, no dental-call carve-out | Best-effort uptime, no formal SLA | Carved SLA with call-coverage failover to live human backup |
Five rows, two attacks per row, one Voicify anchor per row. The IT lead does not read the table the same way the AE does — they read it as a checklist they will return to with their questionnaire response in hand. The rep's job is to make the checklist easy to complete in Voicify's favor and hard to complete in either competitor's.
PMS Integration Depth: The Anchor Domain
PMS integration is the anchor domain because it is where the A-slot horizontal platform's general-purpose architecture cannot follow Voicify into the appointment book. The horizontal platform supports more connectors in the marketing copy — Salesforce, HubSpot, Microsoft Dynamics, Zendesk, ServiceNow, and a long tail of general-purpose CRMs and helpdesks. In dental, none of those matter. The systems that matter are Dentrix, Open Dental, Eaglesoft, Dentrix Ascend, Curve Dental, and a handful of DSO-specific PMS stacks. The horizontal platform supports them through a generic database connector that reads appointment records and exposes them as objects in the platform's data model. What the platform cannot do — and what its architecture cannot easily be retrofitted to do — is write back to the appointment table in a way the practice's database administrator can audit, with the right field-level lineage, the right note attachments, and the right reconciliation with the practice's own appointment-confirmation workflow.
The Voicify response is the PMS data-flow diagram. The SE hands the IT lead a one-page diagram that shows exactly how a new-patient call from an after-hours caller becomes a confirmed appointment in Dentrix, including the field-level write path, the note attachment, the patient-record reconciliation, and the audit trail entry. The diagram is dental-specific, PMS-specific, and version-controlled — there is one for Dentrix, one for Open Dental, one for Eaglesoft, one for Dentrix Ascend. The A-slot competitor does not have the equivalent because the equivalent requires per-PMS engineering investment they have not made. The B-slot competitor often has a depth on one PMS — usually Open Dental — and nothing comparable on the others, which collapses the moment the DSO IT lead names a second PMS in the question.
Security & HIPAA: The Pre-Staged Packet
The Voicify security packet is the artifact the rep hands the IT lead before the questionnaire arrives. The packet contains: current SOC 2 Type II report under mutual NDA, HIPAA Business Associate Agreement template ready for legal review, current sub-processor list with named entities and data-handling descriptions, dental-specific data-flow diagram described above, incident response procedure with named primary and named escalation path, breach notification procedure with the contractually committed window, penetration test attestation, and the SSO and identity-provider configuration guide. The packet is dental-specific in the sense that the data-flow diagram, the BAA, and the sub-processor list reference dental data categories — patient demographic, appointment, clinical notes, payment, insurance — by name.
The B-slot dental-pure competitor often cannot complete a meaningful security questionnaire without manual work-arounds. They lack SOC 2 attestation, their BAA is a one-page boilerplate, their incident response procedure is a paragraph in a help-center article, and their sub-processor list is "available on request" — which translates to "we will think about who to put on this list when you ask." The A-slot horizontal platform completes the questionnaire fast and on platform-wide terms, leaving the dental-specific data-handling questions weak or non-responsive. Voicify's pre-staged packet collapses the IT review from weeks to days for buyers who accept the packet, and surfaces the competitor's gap for buyers who require formal questionnaire completion.
Telephony, Identity, and Failover: The Three Domains Reps Underweight
Telephony is where the B-slot competitor's procurement-simplicity story breaks. The B-slot vendor typically resells from a single carrier with no native number porting, which means the practice that wants to move their existing number into the platform faces a multi-week process the vendor does not own. Voicify supports direct PSTN provisioning, carrier-agnostic SIP, and full port-in and port-out — the practice owns its numbers and the practice can leave. The A-slot horizontal platform supports broad carrier integration but does not own the dental-specific call-routing logic that distinguishes new-patient from existing-patient calls before the AI receptionist picks up. The Voicify SE handed the call-routing diagram alongside the PMS data-flow diagram answers the telephony question end-to-end.
Identity and SSO is the domain reps most often skip and IT leads most often gate on. The A-slot platform supports broad identity providers — Okta, Azure AD, Google Workspace, Ping — but does not support dental-specific role mapping because their data model does not know what a front-desk role versus an ops role versus a clinical role is. Their SCIM provisioning pushes users into a generic role taxonomy the practice has to map manually. Voicify supports SAML 2.0 and SCIM with role mapping to front-desk, operations, and clinical roles built into the directory schema. The B-slot competitor often supports no SSO at all — a single shared login per practice, which the DSO IT lead's auditor will flag the moment they see it.
Failover and SLA is the third underweighted domain. The A-slot platform offers a platform-wide SLA that does not carve out call-coverage uptime as a dental-specific commitment. The B-slot competitor offers best-effort uptime with no formal SLA at all. Voicify offers a dental-specific carved SLA with call-coverage failover to a live-human backup desk during platform incidents — meaning the practice's incoming calls continue to convert during the rare windows the AI receptionist is degraded. The carved SLA is the answer to the IT lead's question that almost always comes last and almost always decides the review: "what happens when your system is down?"
The Five IT Stop-Ship Questions
Five questions stop deals at the IT review more than any other. The rep and SE should rehearse these five answers as a unit before the IT review meeting, with the security packet open and the PMS data-flow diagram on screen. Each question is a Voicify response anchored on a specific document the rep can hand the IT lead in the same meeting.
- "Can we get your SOC 2?" — Hand the current Type II report under mutual NDA in the same call. A-slot has one; B-slot often does not. The hand-off is the differentiator, not the existence.
- "What is your sub-processor list and how do we get notified of changes?" — Hand the named-entity sub-processor list with the contractually committed change-notification window. B-slot rarely has this; A-slot has it but not on dental-specific terms.
- "What does your PMS integration actually write back?" — Show the PMS data-flow diagram for the buyer's specific PMS. A-slot cannot do this at depth; B-slot cannot do this across multiple PMS systems.
- "Can we provision users from our Okta tenant with role mapping?" — Walk through the SAML + SCIM configuration guide. A-slot supports SCIM but not dental-specific roles; B-slot often supports neither.
- "What happens when your system is down?" — Walk through the carved SLA and the live-human failover desk. A-slot has a platform-wide SLA with no dental carve-out; B-slot has no formal SLA at all.
The pattern is consistent across all five: A-slot has the artifact at platform scope but not at dental specificity; B-slot has dental specificity in marketing copy but lacks the underlying artifact. Voicify wins the IT review when the SE hands every artifact in the same meeting the IT lead asks for it.
How the IT Battlecard Hands Off to the Pricing Battlecard
The IT review closes when the IT lead returns the completed vendor security questionnaire to procurement with no stop-ship findings, or when the IT lead joins a follow-up call with the AE and the SE to confirm that the open questions have been answered in writing. The activation cue for the hand-off into the pricing and procurement battlecard is the IT-cleared confirmation in writing — usually an email from the IT lead to procurement with the AE copied. The AE does not advance the deal into pricing negotiation before that email exists. Reps who attempt the pricing close while IT is still in review create a forecast-call problem the manager will not be able to solve. The handoff into the CSM B-slot defense plan happens after pricing close, with the IT-cleared confirmation included in the CRM record so the post-sale account team inherits the security and integration commitments the AE and SE made during the IT review. The commitments outlast the deal cycle; the battlecard makes sure the commitments are logged in the CRM record and not in the AE's notebook.