Security
What we can show you, not what we claim.
Every item below is behaviour in the system that we can demonstrate in a session with your IT team.
Access control
- Role-based permissions, enforced server-side
- Every role sees only what its job requires
- Branch and department scoping on every query
- Permission changes are themselves audited
Identity and sessions
- Two-factor sign-in by OTP or authenticator app
- MPIN for repeat sign-in on a known device
- Device fingerprint checked on token refresh
- Idle sessions time out and require re-auth
Data and consent
- Patient records are consent-gated before access
- Consent is revocable, and revocation takes effect immediately
- Sensitive fields are encrypted at rest
- Data is hosted in Indian regions
Operations
- Append-only, hash-chained audit trail on patient data access
- Nightly reconciliation across the financial ledger
- Automated backups with tested restores
- Change is deployed through reviewed pipelines only
Compliance posture
Where we actually stand.
Our compliance work is oriented to Indian healthcare regulation. We will tell your procurement team exactly what is in place and what is still in progress — in writing, before you sign anything.
Documentation
Send this to your IT team.
Architecture notes, our data-handling summary and the audit-trail design, on request.