Skip to content
MediPosIQ

Security

Designed for enterprise security requirements.

Security is part of the MediPosIQ platform architecture, from how users sign in to how data is isolated, encrypted, logged and recovered.

Request security documentationAdmin documentation

About this page

This page describes the security architecture MediPosIQ is designed around. It is not a certification or compliance claim. We will publish attestations and detailed documentation as they are completed.

Security overview

Principles we build on.

  • Least privilege

    Users, keys and services get only the access they need.

  • Defence in depth

    Controls at identity, application, data and infrastructure layers.

  • Auditability

    Every meaningful action is recorded and exportable.

  • Data minimisation

    Only operational fields needed for the job are ingested.

Authentication

Verified identity for every user and every API client.

  • Email and password with multi-factor authentication
  • Single sign-on via SAML 2.0 or OpenID Connect on Business and Enterprise plans
  • Configurable session lifetime and idle timeout
  • Password policy and breached-password checks

Authorization

Access is decided per organisation, location and department.

  • Every request is checked against the user’s scope
  • Location- and department-level data boundaries
  • Deny-by-default for new resources

Role-based access control

Standard roles out of the box, custom roles on higher plans.

  • Owner, Admin, Manager, Analyst and Viewer roles
  • Custom roles with granular permissions (Business and Enterprise)
  • The AI Assistant only sees data the user is allowed to see

Role permissions

Default role permissions
PermissionOwnerAdminManagerAnalystViewer
View dashboards
Acknowledge alerts
Edit workflows
Manage connectors
Export data
Manage users & roles
Billing

Encryption

Data is protected in transit and at rest.

  • TLS 1.2+ for all traffic
  • Encryption at rest for databases, backups and file storage
  • Secrets held in a managed secrets store, never in code

Audit logs

Who did what, when, and from where.

  • Sign-ins, permission changes and configuration changes
  • Data exports, workflow runs and AI queries
  • Exportable logs with plan-based retention

Audit log

Illustrative
Sample audit log entries
TimeActorActionTarget
14:52:08a.menon@demo-care.exampleworkflow.updatedDischarge follow-up
14:47:31systemconnector.sync.completedLab system feed
14:41:02r.iyer@demo-care.examplerole.assignedManager → North Campus
14:30:44k.shah@demo-care.examplereport.exportedDaily operations (PDF)
14:22:19api-key:ops-biapi.requestGET /v1/analytics

Data isolation

Each organisation’s data is logically isolated.

  • Tenant identifier enforced at the data-access layer
  • Isolation tests in the release pipeline
  • Advanced isolation options for Enterprise

API security

Least-privilege access for integrations.

  • Scoped API keys with rotation and expiry
  • Rate limiting per key
  • Signed webhook payloads with replay protection

Monitoring

Continuous visibility into platform health and security events.

  • Infrastructure and application monitoring with alerting
  • Anomalous sign-in and access detection
  • Documented incident response process

Backups

Recoverable by design.

  • Automated encrypted backups
  • Point-in-time recovery for primary databases
  • Regular restore testing

Enterprise controls

Administration for organisations with strict requirements.

  • SSO enforcement and SCIM provisioning (planned)
  • IP allow-listing (planned)
  • Configurable data retention and full data export
  • Custom data processing terms

Data handling

Operational focus and data minimisation.

  • CareOps is built for operational data such as capacity, flow and turnaround
  • Connectors are configured to ingest only the fields needed
  • Customer data is not used to train shared AI models

Compliance roadmap

MediPosIQ does not currently claim any security certification or regulatory compliance attestation. We are designing the platform with enterprise and healthcare data-protection expectations in mind and will publish certifications, audit reports and our data processing terms here once they are complete.

Responsible disclosure

If you believe you have found a security issue, please contact security@mediposiq.com. Please do not access data that isn’t yours or disrupt the service.

Need details for a security review?

Tell us about your requirements and we’ll share our architecture documentation and answer your questionnaire.

Request security documentationTalk to Sales