Security
Hospital data, handled like it matters.
This page describes how Curanto is built and operated today. It is written for the administrator, the IT consultant and the auditor. Questions or disclosures go to security@curanto.in.
Built like infrastructure
Hospital data security and AI guardrails, built in.
Trust is not a feature. It is how the system is built. Hospitals hold the most sensitive data there is. Curanto treats tenancy, audit, money and offline as architecture, enforced at the database and on every device, not as settings that can be switched off.
Read the security overviewIsolation at the row
Every row carries the organisation. Postgres row-level security, sync rules and the domain layer each enforce it. UI hiding is never the security.
Hash-chained audit
An append-only, per-organisation audit log where each entry seals the one before it. Verified nightly; tampering is detectable, not deniable.
AI inside the lines
Medi acts with the asking user's permissions and audit trail, drafts stay drafts until a person signs, and an administrator can switch AI off for the organisation.
Money is authoritative
Invoice numbers, finalisation and audit appends are issued only by the server. Nothing about money is ever optimistic.
No PHI in telemetry
Crash reports and analytics are scrubbed at the SDK boundary with an allowlist of safe fields, so patient data never reaches them.
Backups you can restore
Nightly encrypted backups with restore drills and per-tenant export on request.
Where data lives
Where it is stored
The database runs on our server in Mumbai, India. Uploaded files and the encrypted nightly backups are kept in Cloudflare R2's Asia-Pacific region, which may be outside India.
Encryption
TLS 1.2+ in transit. Encryption at rest for the database, file storage and the local cache on every device.
Files off the database
Scans, consents and reports live in object storage behind presigned, expiring URLs; only metadata is in the database.
Who can see what
Tenant isolation, four times over
Every row carries the organisation id. Postgres row-level security, per-organisation sync rules, and domain-service checks each enforce it independently. Hiding a button is never the control.
Roles and least privilege
Role-based permissions with per-user overrides, session policies, 2FA and lockout. The application connects to the database as a role that cannot bypass RLS.
Patient portal scoping
Portal reads switch to a lower-privilege database role with patient-scoped policies, so a missing filter in code cannot leak another patient's record.
What is recorded
Hash-chained audit
An append-only audit log per organisation where each entry seals the previous one. The chain is verified on a schedule; tampering is detectable.
Access logging
Record views are logged with user, time and origin and are reportable to administrators.
Server-authoritative money
Invoice, admission and claim numbers are issued by the server from sequences under locks. Finalisation never happens optimistically or offline.
Privacy and the DPDP Act
Consent records
Consent capture and a registry per patient, with purpose and evidence stored alongside.
Data-principal requests
Access, correction and erasure requests handled through a tracked workflow, with anonymisation after retention windows.
No PHI in telemetry
Error and analytics events are scrubbed at the SDK boundary with an allowlist of safe fields. Marketing pages set no tracking cookies.
AI features
What the AI sends
Only the text a feature needs when someone uses it. The scribe never stores audio and removes names, phone numbers, Aadhaar numbers, dates of birth and emails from the transcript before a language model reads it.
Where it is processed
AI requests go to model providers through OpenRouter and may be processed outside India. The database is hosted in India; the AI page lists what each feature sends.
Controls
AI acts with the asking user's permissions and row-level security, every action is audited, plans carry a monthly usage cap, and an administrator can switch AI off.
Resilience
Backups and restore drills
Nightly encrypted backups with freshness monitoring and scheduled restore drills. Per-organisation export on request.
Offline operation
An encrypted local copy keeps daily work running through outages; changes reconcile in order when the link returns.
Monitoring
External uptime checks on the product, API and sync service, with alerting to the founding team.
Have a security questionnaire?
Send it over. We answer vendor assessments in full, and we would rather you ask before you buy.
Or write to sales@curanto.in. We reply within one working day, Mon to Sat, 10:00 to 19:00 IST.