Security and data ownership
Synvian is built for health information from the first line of code. This page says what we do, in terms your IT reviewer can check.
- Your data is yours
- The clinic owns every record. You can export your data at any time while you subscribe, and for a set period after the subscription ends, as the Terms set out.Read the Terms
- Tenant isolation
- Each clinic's data is separated at the database level. Row-level security is enforced on every query, so a request from one clinic cannot read another clinic's rows even if the application code has a bug.
- Encryption
- TLS protects every connection. Identifiers such as insurance numbers and dates of birth are encrypted field by field inside the database with AES-GCM, and the keys are held outside the database.
- Access control
- Role-based permissions decide what each person can see and do, screen by screen and action by action. Sessions live in secure HttpOnly cookies, never in browser storage.
- Audit trail
- Every read and every change of a patient record is written to an append-only audit log in the same database transaction as the action itself. No application role can edit or delete an audit row.
- Logging without patient data
- Operational logs carry the request name, the user, the clinic and a correlation ID. They never carry patient data, so a log file is not a second copy of the chart.
- Backups
- [Backup frequency, retention period and restore-test cadence to be published]
- Hosting
- India, with additional regions on request.
- Compliance
- Built to HIPAA requirements, with a Business Associate Agreement for US clinics. Operated as a Data Processor under India's Digital Personal Data Protection Act 2023. [Under legal review]
- Vulnerability handling
- Report a vulnerability to [security@intelligencehut.com]. [Response commitment to be published]
Questions from your IT review?
Send us the questionnaire. An engineer who works on Synvian answers it, not a sales team.
See Synvian with your own workflow.
A 30-minute walkthrough with an engineer who built it, not a sales script. Bring your hardest scheduling day.