Workspace boundaries
Tenant-scoped application checks and PostgreSQL row-level security separate workspace data. User roles control available actions.
Security & data handling
Understand the data path before you connect.
Workspace isolation, role-based access and recorded review actions are built into the application. Deployment settings and provider agreements still need review before processing patient information.
Accountable review
Report sign-off records the reviewer and time. Audit records support inspection of application actions; they are not an independent security certification.
Private source storage
Source uploads are stored and retrieved through the configured S3 service. Bucket access, encryption, region and backups must match the deployment’s requirements.
What goes where
| Information | Application handling | Confirm before use |
|---|---|---|
| Uploaded reports & reference files | Configured S3 storage; associated metadata in the database. | Bucket region, access, encryption, retention and deletion. |
| Report drafts, reviews & feedback | Application database, scoped to the workspace. | Authorized users, database location, backups and retention. |
| AI requests | Selected report content and retrieved references may be sent to the configured model provider. | Provider, endpoint, data agreement, retention and training terms. |
| Knowledge Base retrieval | Document text is indexed for retrieval within the workspace. | Document access, indexing services and removal procedures. |
| Training dataset exports | Administrator-controlled tools can export reviewed report data for a separate training workflow. | Authorization, permitted uses, de-identification review and handling of exported files. |
| Public synthetic demo | Teaching cases and edits run in page memory using local rules; no patient upload is needed. | Use the supplied fictional cases, not patient information. |
Transparent about our current stage
No independent compliance certification or medical-device clearance is claimed here. Enterprise SSO, vendor-specific integrations and contractual data arrangements must be confirmed separately.
Review your deployment with us
Before using identifiable patient information, agree access, storage region, provider processing, retention, deletion and incident contact arrangements with your centre.