Security
Hospital data, handled like it matters.
This page describes how Curanto is built and operated today. It is written for the administrator, the IT consultant and the auditor. Questions or disclosures go to security@curanto.in.
Built like infrastructure
Trust is not a feature. It is how the system is built.
Hospitals hold the most sensitive data there is. Curanto treats tenancy, audit, money and offline as architecture, enforced at the database and on every device, not as settings that can be switched off.
Read the security overviewIsolation at the row
Every row carries the organisation. Postgres row-level security, sync rules and the domain layer each enforce it. UI hiding is never the security.
Hash-chained audit
An append-only, per-organisation audit log where each entry seals the one before it. Verified nightly; tampering is detectable, not deniable.
Offline by design
An encrypted local copy on each device keeps the desk and ward working through outages. The sync engine reconciles when the link returns.
Money is authoritative
Invoice numbers, finalisation and audit appends are issued only by the server. Nothing about money is ever optimistic.
No PHI in telemetry
Crash reports and analytics are scrubbed at the SDK boundary with an allowlist of safe fields. Patient data never leaves the record.
Backups you can restore
Nightly encrypted backups with restore drills, per-tenant export on request, and data residency in India.
Where data lives
Indian residency
Production data is stored in the Mumbai (ap-south-1) region. Backups stay in India.
Encryption
TLS 1.2+ in transit. Encryption at rest for the database, file storage and the local cache on every device.
Files off the database
Scans, consents and reports live in object storage behind presigned, expiring URLs; only metadata is in the database.
Who can see what
Tenant isolation, four times over
Every row carries the organisation id. Postgres row-level security, per-organisation sync rules, and domain-service checks each enforce it independently. Hiding a button is never the control.
Roles and least privilege
Role-based permissions with per-user overrides, session policies, 2FA and lockout. The application connects to the database as a role that cannot bypass RLS.
Patient portal scoping
Portal reads switch to a lower-privilege database role with patient-scoped policies, so a missing filter in code cannot leak another patient's record.
What is recorded
Hash-chained audit
An append-only audit log per organisation where each entry seals the previous one. The chain is verified on a schedule; tampering is detectable.
Access logging
Record views are logged with user, time and origin and are reportable to administrators.
Server-authoritative money
Invoice, admission and claim numbers are issued by the server from sequences under locks. Finalisation never happens optimistically or offline.
Privacy and the DPDP Act
Consent records
Consent capture and a registry per patient, with purpose and evidence stored alongside.
Data-principal requests
Access, correction and erasure requests handled through a tracked workflow, with anonymisation after retention windows.
No PHI in telemetry
Error and analytics events are scrubbed at the SDK boundary with an allowlist of safe fields. Marketing pages set no tracking cookies.
Resilience
Backups and restore drills
Nightly encrypted backups with freshness monitoring and scheduled restore drills. Per-organisation export on request.
Offline operation
An encrypted local copy keeps daily work running through outages; changes reconcile in order when the link returns.
Monitoring
External uptime checks on the product, API and sync service, with alerting to the founding team.
Have a security questionnaire?
Send it over. We answer vendor assessments in full, and we would rather you ask before you buy.
Or write to sales@curanto.in. We reply within one working day, Mon to Sat, 10:00 to 19:00 IST.