Built to keep every organization's data its own
Isolation, least-privilege access and traceability are part of the platform's architecture, not settings added afterwards.
How tenant isolation works
Four layers keep one organization's records out of another's reach.
-
1
Verified address
Every request is matched to an organization from the hostname it arrives on, checked against the central registry. A tenant identifier sent by the browser is never trusted.
-
2
Own database
The organization's data lives in its own database, with its own database user where enabled. Other organizations' databases are never opened in that request.
-
3
Scoped sessions
A sign-in belongs to one organization. A session carried to another organization's address is discarded.
-
4
Separate control plane
The central platform holds only organizations, domains and subscriptions. Platform administrators have no screen for browsing clinical records.
Patient data, protected by design
Isolation, least-privilege access and traceability are built into the platform, not added afterwards.
Our commitment
We only describe controls that are implemented. Compliance with Saudi healthcare and data-protection requirements depends on each deployment; we work through it with your team during onboarding.
-
Available
Role-based access control
Granular permissions per screen and action, assigned through roles.
-
Available
Tenant data isolation
A separate database and database user per organization, resolved from the verified hostname.
-
Available
Permission-controlled medical records
Clinical records are visible only to roles granted access.
-
Available
Audit trails
User activity and platform administration actions are logged.
-
Available
Session management
Server-side sessions, scoped to a single organization.
-
Available
Secure API authentication
OAuth2 access tokens for mobile, POS and partner apps.
-
Available
Encrypted credentials
Database credentials and secrets are stored encrypted.
-
Available
Encryption in transit
HTTPS/TLS on every production domain.
-
Planned
Backup and disaster recovery
Per-organization backups and restore procedures.
-
Planned
Multi-factor authentication
A second factor for administrators and clinical staff.
Access is granted, not assumed
Administrators of a hospital manage their own users and roles. Nobody receives platform-level administration because they administer a hospital, and platform administrators sign in separately.
A trail of who did what
User activity inside each organization and every platform administration action, such as creating or suspending an organization, is recorded.
On our roadmap
Per-organization automated backups with documented restore procedures, and multi-factor authentication, are planned. They are labeled that way until they ship.
Questions from your security team?
We will walk your IT and compliance teams through the architecture.