Security and trust
Patient data deserves boring, provable safety.
Here is what is built in, and, just as plainly, what is still in progress. We would rather you ask than assume.
Each hospital sealed off
Every table holding hospital data has row-level security in the database. The application cannot bypass it, and an automated suite checks every table on every build.
Append-only audit
Every change, every opening of a patient record, every assistant proposal and approval is written to an audit log that the application can only append to.
Who can do what
Forty-five ready-made roles, permissions per module and branch, delegations with an end date, and an access review for administrators.
Sign-in
Invite-only accounts, two-factor sign-in for administrators and finance, short sessions, rate-limited attempts, and sessions revoked on a password reset.
Sensitive records
Medico-legal, VIP, staff and other restricted records are masked from anyone without the right. Opening one needs a reason, and the opening is audited.
Non-clinical AI
Assistants run as the signed-in person. Questions about diagnosis, dosing or treatment are refused in code before any model is called. Identifiers are masked before text leaves the hospital, and anything that would change a record waits for a person to approve.
Browser protections
A strict content-security policy, no third-party scripts on the application, HSTS, and no framing.
Hosting you control
The platform is built to run on infrastructure you choose. Backups, key management and data residency are agreed with you as part of the deployment.
Certifications
What we hold, and what we don't yet.
We do not claim certifications we have not earned. The platform has been reviewed internally against its own security specification, with the findings and fixes written up. An external penetration test is planned before real patient data is hosted, and ISO 27001 and SOC 2 are on the roadmap.
ABDM certification (M1 to M3) depends on sandbox access and the hospital's own facility registration, and is in progress. NABH accredits hospitals, not software; the platform is built to support the standards and keep the evidence.
If a certification matters to your tender, ask us where it stands. We will tell you the date, not a promise.
Ask our security questions before you ask the others.
A thirty-minute walkthrough with someone who knows hospitals, then a rollout plan for your beds, branches and modules.