Sentia DPDP posture
Purpose-limited processing, patient ownership, revoke paths in Companion, and organisation-controlled retention for real deployments.
Clinical systems earn trust with mechanics — not slogans. Here is what the evaluation build actually does, and where honesty still matters.
Never cleartext. Never logged. Minimum length enforced on register. Demo seed password is documented for evaluation only.
Role and subject bound — cannot forge another clinician’s principal or mint arbitrary roles.
API JSON bodies encrypt after login for the 8-hour session window with live timer and auto sign-out.
Kernel enforces TREAT grants on FHIR search and chart assembly. Companion revoke is immediate.
Event streams are hash-chained; tampering fails integrity checks. Lossless replay is a kernel gate.
Clients avoid payload analytics. Tokens stay out of third-party telemetry on this stack.
Browser DevTools on a compromised device can still inspect memory. Transport encryption hardens Network-tab snooping — it is not a substitute for device posture, SSO, HSTS, hardened CSP, and organisation policy in production deployments.
Purpose-limited processing, patient ownership, revoke paths in Companion, and organisation-controlled retention for real deployments.
Demo OTP linking and directory scaffolds exist for national identity paths. Production binds to sandbox and programme rules.
AI drafts. Humans sign. Nothing unsigned enters the kernel. Rx checks are advisory flags only.
8-hour window, live elapsed/remaining chrome, auto logout on expiry, encrypted session key held in client memory only.
| Control | Mechanism |
|---|---|
| Password storage | scrypt hash · never cleartext |
| API identity | HMAC-bound principal |
| Transport (post-login) | AES-256-GCM body encryption |
| Clinical reads | x-consent-ref / TREAT grant |
| Integrity | Append-only hash-chained events |