Vellum Health · Custody model Last reviewed [DATE] · Version [N]
VELLUMHEALTH
Request access

03Custody

Where the data sits, who holds the keys, and what we can see.

This page is written to be sent straight to a security reviewer. It states mechanisms, not adjectives. Where a value is bracketed, it is a placeholder your team fills in — we do not publish a control we cannot evidence.

Fig. 1 — Path of one record Plaintext exists only left of the dashed line
VELLUM HEALTH — DESIGN INTENT: NO PLAINTEXT AT REST PATIENT DEVICE plaintext, in memory never leaves unsealed SEAL AES-256-GCM one key per record GATEWAY [YOUR REGION] TLS 1.3 terminates here KEY SERVICE [YOUR KMS] separate account STORE ciphertext only encrypted backups CONSENT LEDGER append-only · patient-readable written before any response A read with no matching grant stops at the gateway. There is no administrative override.

Controls

Open a row to see the mechanism and how it is evidenced.

Nothing below is verified yet

Every row states a control we intend to operate and the standard it maps to. None has been independently audited. Each stays marked [CONFIRM] until we can produce the evidence named beside it — then the marker comes off, one row at a time.

Encryption3 controls
Envelope encryption, one data key per recordISO 27001 A.8.24Claimed — [CONFIRM]
Mechanism
Each record gets its own AES-256-GCM data key. That key is wrapped by a customer-scoped master key held in [YOUR KMS]. Compromising one record does not widen to a second.
Evidence
Key hierarchy diagram plus a [YOUR KMS] policy export showing no unwrapped key material leaves the service.
Client-side sealing before transmissionISO 27001 A.8.24Claimed — [CONFIRM]
Mechanism
The mobile and web clients seal the record before it reaches the network, so the gateway handles ciphertext it cannot open.
Evidence
Source review of the client crypto module and a packet capture from the [YOUR REGION] gateway.
Crypto-shredding on deletionGDPR Art. 17Claimed — [CONFIRM]
Mechanism
Deletion destroys the data key rather than rewriting storage. Remaining ciphertext, including in backups, becomes unrecoverable within [N] hours.
Evidence
Key destruction log with timestamps, reconciled against the deletion request queue each [PERIOD].
Identity and access3 controls
No standing staff access to record contentISO 27001 A.5.15Claimed — [CONFIRM]
Mechanism
Staff hold no data keys. A support request needs a patient-approved grant, scoped to named fields, with an expiry the patient sets.
Evidence
A ledger export showing every staff read in the last [N] days, each with its originating grant.
Phishing-resistant MFA for all internal accountsISO 27001 A.5.17Claimed — [CONFIRM]
Mechanism
Hardware security keys only. TOTP and SMS are disabled at the identity provider, not merely discouraged.
Evidence
Identity provider policy export plus an enrolment report covering [N] of [N] accounts.
Break-glass access is announced, not silentISO 27001 A.8.15Planned [Q] — [CONFIRM]
Mechanism
Emergency access requires two approvers and writes a visible entry to the affected patient ledger. There is no mode that hides a read.
Evidence
Runbook, approver list, and a rehearsal record from the last [PERIOD] tabletop.
Network and platform3 controls
TLS 1.3 only, HSTS preloadedISO 27001 A.8.20Claimed — [CONFIRM]
Mechanism
Older protocol versions are refused at the edge. The apex domain is on the HSTS preload list, so a first visit is already protected.
Evidence
Third-party TLS scan report and the preload list entry for [DOMAIN].
No third-party scripts on record surfacesGDPR Art. 32Claimed — [CONFIRM]
Mechanism
Pages that display record content load no analytics, no tag manager, no ad pixel, and no CDN-hosted script. Content Security Policy enforces it rather than trusting review.
Evidence
The published CSP header plus a report-only violation log for the last [N] days.
Data residency pinned to one regionGDPR Ch. VClaimed — [CONFIRM]
Mechanism
Storage, compute, and backups stay in [YOUR REGION]. Scaling, support, and analytics do not move a record across a border.
Evidence
Infrastructure-as-code review showing region constraints, plus the subprocessor table below.
Operations and people3 controls
Independent penetration test each [PERIOD]ISO 27001 A.8.8Claimed — [CONFIRM]
Mechanism
A scoped external test covering the clients, the gateway, and the grant model. Findings are tracked to closure with a published severity clock.
Evidence
Summary letter from [YOUR TESTER], [MONTH YEAR], and the remediation ticket history.
Restore rehearsed, not assumedISO 27001 A.8.13Claimed — [CONFIRM]
Mechanism
Backups are restored into an isolated environment each [PERIOD] and checked against a known-good record hash. An untested backup is not a backup.
Evidence
Restore run log with the operator, duration, and hash comparison for each rehearsal.
Background checks and annual security trainingISO 27001 A.6.1Claimed — [CONFIRM]
Mechanism
Every person with production access clears a check appropriate to [YOUR JURISDICTION] and re-trains annually on the grant model specifically.
Evidence
Completion register, [N] of [N] staff, current as of [DATE].

Subprocessors

Everyone who could touch a byte, and what they can actually read.

ProviderPurposeLocationCan read record content
[YOUR CLOUD]Compute, storage, backups[YOUR REGION]No — ciphertext only
[YOUR KMS]Master key custody[YOUR REGION]No — wraps keys only
[EMAIL PROVIDER]Transactional email[REGION]No — no record content in email
[ERROR TRACKER]Crash reports[REGION]No — record fields scrubbed at the client
[SUPPORT DESK]Patient support tickets[REGION]Only what a patient pastes in

Changes are announced [N] days before they take effect.

If something goes wrong

We publish the clock we are held to.

Within [N] hA named incident lead is assigned and a public status page entry is opened, before the cause is known.
Within [N] hAffected patients and clinics are told what we know, what we do not, and which records are in scope — by name, not by cohort.
Within [N] hRegulator notification to [YOUR REGULATOR] where the threshold is met, with the assessment attached rather than summarised.
Within [N] dA written post-incident report published to the same page, including what we changed and what we chose not to change.
Coordinated disclosure

Found something? We will not send a lawyer. Safe-harbour terms, a named human, and a published response window.

security@[DOMAIN] /.well-known/security.txt PGP [FINGERPRINT] First response within [N] hours
Read the policy