How we keep your clinic's data safe
The short version first, then the details your IT team or data protection officer will ask for.
Where does Salisan store patient data?
On Amazon Web Services in Frankfurt, Germany (eu-central-1). The database, files and backups stay in that region, an automated test blocks replication to another one, and AI requests are processed in the EU.
Is our data used to train AI models?
No. We don’t use your data to train AI models, and our AI provider’s contract doesn’t allow it either.
Does Salisan have ISO 27001 or SOC 2?
Not yet. We are working toward ISO 27001 certification and a SOC 2 Type 2 report, and we share our progress on our trust portal.
Can people at Salisan see our patients’ data?
Salisan’s platform roles give no access to patient data, and nobody at Salisan can sign in as one of your users. Access to our infrastructure needs single sign-on with multi-factor authentication and short-lived credentials.
For technical teams
Our data processing agreement makes everything below binding.
Encryption
- TLS 1.2 or higher on every public endpoint, with HSTS. Connections to the database and cache use TLS too.
- AES-256 encryption at rest for the database and its backups, files, the cache, the audit archive and logs.
Sign-in
- Email verification, a check against known breached passwords, and rate limits on sign-in attempts.
- Two-factor authentication with an authenticator app, passkeys, Google sign-in, and single sign-on with OpenID Connect on the Enterprise plan.
- Your practice can require two-factor authentication for every member.
- Sessions end after 7 days without use. Changing your password signs out your other devices.
Access control
- Every request is checked on the server for the organisation and the patient, including requests made by AI tools and background jobs.
- You manage members, roles, teams and which patients each clinician can see. Custom roles are on the Enterprise plan.
Audit trail
- Every read, search, change, export and deletion of patient data writes an audit record in the same database transaction. If the record can't be written, the action fails.
- A signed copy goes to a write-once archive. Access records are kept for at least 5 years in the Netherlands and 3 years in Germany.
- A patient's access log is included in their data export, and each change to the record shows who made it and when.
AI
- AI models run on Melious, inside the EU. Speech-to-text runs on Amazon Transcribe in Frankfurt.
- Patient tools give the AI an age instead of a date of birth, and no address, contact details or national identification numbers.
- Patients you exclude, and patients under 18 unless the practice turns this on in Settings, are kept out of every AI feature, including document reading and transcription.
- Emails, forms and appointments the Agent prepares wait for approval. Changes to the record are proposed and join it only when a clinician keeps them.
- Web research sends only a de-identified question and is blocked if an identifier is found.
Backups, export and deletion
- Database point-in-time recovery and earlier file versions are kept for 35 days. The production database has deletion protection.
- Export one patient or your whole organisation at any time, as a ZIP with JSON, Markdown and readable HTML.
- Patient erasure removes every stored version of the patient's data and files, checks that nothing is left, and issues a certificate. Backup copies expire within 35 days, and a restore applies every erasure again.
- Clinical records are never deleted on a timer. Your practice decides, within your country's legal minimums.
Files and logs
- Uploads are limited to PDF, JPEG, PNG, WebP and audio. A PDF or image must really be the type it claims to be.
- Patient files are stored privately. Every download goes through our server, which checks access and records it.
- Uploaded PDFs and images are read by the AI so the Agent can use them.
- Application logs keep only allow-listed fields, are redacted and are kept for 30 days. AI traces carry no inputs or outputs. Emails to patients carry no open or click tracking.
Found a security issue?
Tell us privately and we’ll work with you to fix it. We acknowledge every report within 3 business days, and we won’t take legal action over good-faith research that follows our policy.
- Include the affected URL or feature, the steps to reproduce and the impact.
- Don’t send real patient data. Describe what kind of data you saw instead.
- Give us reasonable time to fix it before you disclose it publicly.
Questions
Send questions or your practice's security questionnaire to security@salisan.com