03Custody
Where the data sits, who holds the keys, and what we can see.
This page is written to be sent straight to a security reviewer. It states mechanisms, not adjectives. Where a value is bracketed, it is a placeholder your team fills in — we do not publish a control we cannot evidence.
Fig. 1 — Path of one record
Plaintext exists only left of the dashed line
Controls
Open a row to see the mechanism and how it is evidenced.
Nothing below is verified yet
Every row states a control we intend to operate and the standard it maps to. None has been independently audited. Each stays marked [CONFIRM] until we can produce the evidence named beside it — then the marker comes off, one row at a time.
Encryption3 controls
Envelope encryption, one data key per recordISO 27001 A.8.24Claimed — [CONFIRM]
- Mechanism
- Each record gets its own AES-256-GCM data key. That key is wrapped by a customer-scoped master key held in [YOUR KMS]. Compromising one record does not widen to a second.
- Evidence
- Key hierarchy diagram plus a [YOUR KMS] policy export showing no unwrapped key material leaves the service.
Client-side sealing before transmissionISO 27001 A.8.24Claimed — [CONFIRM]
- Mechanism
- The mobile and web clients seal the record before it reaches the network, so the gateway handles ciphertext it cannot open.
- Evidence
- Source review of the client crypto module and a packet capture from the [YOUR REGION] gateway.
Crypto-shredding on deletionGDPR Art. 17Claimed — [CONFIRM]
- Mechanism
- Deletion destroys the data key rather than rewriting storage. Remaining ciphertext, including in backups, becomes unrecoverable within [N] hours.
- Evidence
- Key destruction log with timestamps, reconciled against the deletion request queue each [PERIOD].
Identity and access3 controls
No standing staff access to record contentISO 27001 A.5.15Claimed — [CONFIRM]
- Mechanism
- Staff hold no data keys. A support request needs a patient-approved grant, scoped to named fields, with an expiry the patient sets.
- Evidence
- A ledger export showing every staff read in the last [N] days, each with its originating grant.
Phishing-resistant MFA for all internal accountsISO 27001 A.5.17Claimed — [CONFIRM]
- Mechanism
- Hardware security keys only. TOTP and SMS are disabled at the identity provider, not merely discouraged.
- Evidence
- Identity provider policy export plus an enrolment report covering [N] of [N] accounts.
Break-glass access is announced, not silentISO 27001 A.8.15Planned [Q] — [CONFIRM]
- Mechanism
- Emergency access requires two approvers and writes a visible entry to the affected patient ledger. There is no mode that hides a read.
- Evidence
- Runbook, approver list, and a rehearsal record from the last [PERIOD] tabletop.
Network and platform3 controls
TLS 1.3 only, HSTS preloadedISO 27001 A.8.20Claimed — [CONFIRM]
- Mechanism
- Older protocol versions are refused at the edge. The apex domain is on the HSTS preload list, so a first visit is already protected.
- Evidence
- Third-party TLS scan report and the preload list entry for [DOMAIN].
No third-party scripts on record surfacesGDPR Art. 32Claimed — [CONFIRM]
- Mechanism
- Pages that display record content load no analytics, no tag manager, no ad pixel, and no CDN-hosted script. Content Security Policy enforces it rather than trusting review.
- Evidence
- The published CSP header plus a report-only violation log for the last [N] days.
Data residency pinned to one regionGDPR Ch. VClaimed — [CONFIRM]
- Mechanism
- Storage, compute, and backups stay in [YOUR REGION]. Scaling, support, and analytics do not move a record across a border.
- Evidence
- Infrastructure-as-code review showing region constraints, plus the subprocessor table below.
Operations and people3 controls
Independent penetration test each [PERIOD]ISO 27001 A.8.8Claimed — [CONFIRM]
- Mechanism
- A scoped external test covering the clients, the gateway, and the grant model. Findings are tracked to closure with a published severity clock.
- Evidence
- Summary letter from [YOUR TESTER], [MONTH YEAR], and the remediation ticket history.
Restore rehearsed, not assumedISO 27001 A.8.13Claimed — [CONFIRM]
- Mechanism
- Backups are restored into an isolated environment each [PERIOD] and checked against a known-good record hash. An untested backup is not a backup.
- Evidence
- Restore run log with the operator, duration, and hash comparison for each rehearsal.
Background checks and annual security trainingISO 27001 A.6.1Claimed — [CONFIRM]
- Mechanism
- Every person with production access clears a check appropriate to [YOUR JURISDICTION] and re-trains annually on the grant model specifically.
- Evidence
- Completion register, [N] of [N] staff, current as of [DATE].
Subprocessors
Everyone who could touch a byte, and what they can actually read.
ProviderPurposeLocationCan read record content
[YOUR CLOUD]Compute, storage, backups[YOUR REGION]No — ciphertext only
[YOUR KMS]Master key custody[YOUR REGION]No — wraps keys only
[EMAIL PROVIDER]Transactional email[REGION]No — no record content in email
[ERROR TRACKER]Crash reports[REGION]No — record fields scrubbed at the client
[SUPPORT DESK]Patient support tickets[REGION]Only what a patient pastes in
Changes are announced [N] days before they take effect.
If something goes wrong
We publish the clock we are held to.
Within [N] hA named incident lead is assigned and a public status page entry is opened, before the cause is known.
Within [N] hAffected patients and clinics are told what we know, what we do not, and which records are in scope — by name, not by cohort.
Within [N] hRegulator notification to [YOUR REGULATOR] where the threshold is met, with the assessment attached rather than summarised.
Within [N] dA written post-incident report published to the same page, including what we changed and what we chose not to change.
Coordinated disclosure
Found something? We will not send a lawyer. Safe-harbour terms, a named human, and a published response window.
-
security@[DOMAIN]
/.well-known/security.txt
PGP [FINGERPRINT]
First response within [N] hours