12 layers between an attacker and your patient's record

TLS 1.3 · TURN over TLS · IP allowlist for admin · WAF.

Prevents: Eavesdropping · MITM · admin endpoint discovery

OAuth + email-password · 2FA mandatory clinical and admin · biometric optional · session rotation.

Prevents: Credential theft · session hijacking

Row-level security per tenant_id and role.

Prevents: Cross-tenant data leak via SQL injection or app bug

Policy layer on every endpoint · scope checks.

Prevents: Privilege escalation via API misuse

Role-gated rendering · feature-flag visibility.

Prevents: Accidental exposure of features outside permission scope

Encrypted volumes · separate keys for biometric and KYC vaults · KMS-managed.

Prevents: Disk theft · backup leak

ClamAV on every upload · quarantine on suspicion.

Prevents: Malware delivery via documents

SHA-256 envelope hashes all PHI events · tamper-evident.

Prevents: Silent data tampering

Dynamic per-viewer watermark on every PHI render · screenshot attribution.

Prevents: Untraceable leaked screenshots

9 append-only tables · immutable at the DB role level.

Prevents: Internal misuse going undetected

ML on access patterns · flags unusual contact-view bursts · off-hour PHI access.

Prevents: Insider threats · compromised accounts

Super admin PHI access requires reason + two-person approval + separate audit log · time-bounded.

Prevents: Super admin abuse