Patient data deserves the highest level of protection. Our security architecture is built from the ground up with NHS requirements in mind.
Medelic is in development. The statuses below are current and will be updated as each assessment completes.
Security isn't bolted on to Medelic - it's fundamental to how we build. Every architectural decision, from database design to API structure, considers security implications first.
We apply the principle of least privilege throughout our systems. Access to patient data is controlled by role-based permissions, and key actions are logged. No one at Medelic can access patient information without explicit authorisation and a valid clinical or operational reason.
We review every code change and scan dependencies for known vulnerabilities on every build. Independent penetration testing and a bug bounty programme are planned.
Data encrypted in transit (TLS, HTTPS enforced). Patient MFA secrets and clinical system credentials encrypted at rest (AES-256). HSM-backed key management is planned.
The Medelic API and database are hosted on AWS in London, UK. A documented data residency review across storage and sub-processors is planned.
24/7 security monitoring with automated threat detection and response. Real-time alerting for suspicious activity.
We only collect and process data that's necessary for the clinical purpose. A retention job removes data once its retention period has passed, with a deletion log. Scheduled runs are coming soon.
Strict role-based access controls ensure only authorised personnel can access patient data, with audit trails of key actions.
Audit logs record key actions, including authorisation decisions, configuration changes and patient record changes, for compliance and investigation purposes.
We're happy to discuss our security architecture in detail with your IT and IG teams. Get in touch to arrange a technical deep-dive.