Security

Account and organization access is controlled in the database. Surgeons decide which facilities can access shared professional records and may revoke access.

Documents use private storage and original-file links that expire after 60 seconds. An already downloaded copy cannot be recalled. Malware scanning is not connected yet; restricted view-only previews are not available yet.

Two-step verification is available and can be required by an organization. Administrative actions use a tamper-evident audit log.

What we do not claim yet

No HIPAA attestation, SOC 2 report or independent penetration-test report is claimed. This is a non-patient-data pilot.