Audit & Compliance. Evidence, not assurances.
When a regulator, an auditor or a patient asks who saw a record, 'our logs show' is not an answer — 'here is a cryptographically signed chain proving it' is. MediVault records every access before releasing any data.
- Events written
- 1.2 bn
- Ledger
- Hash-chained
- Audit latency
- +6 ms
- Retention
- Life + 10 yr
A paper trail
you could physically pull from a drawer.
The card index is what that guarantee looked like before it was digital: inspectable, hard to alter without a trace. The hash-chained ledger is the same guarantee, restored, at a scale a filing cabinet never could hold.
- 1.2 bn
- Audit events written
- Hash-chained
- Ledger structure
- +6 ms
- Latency cost per read
- Life + 10 yr
- Retention
Six questions,
answered every time.
An audit log that records only 'user X opened record Y' is close to useless in an investigation. MediVault captures the six dimensions an inquiry actually needs.
Authenticated identity, role, organisation and delegation chain
Exact resource, field-level scope and record version accessed
Signed timestamp from a Swiss NTP-disciplined time source
Source network, device posture, geography and access channel
Authorisation basis: care relationship, consent or break-glass
Before / after diff for every write, with immutable prior version
{
"auditEventId": "evt_01JKX9Q4C7YB2N8MZ",
"sequence": 1204778391,
"previousHash": "sha512:9f14c0a3…b72e",
"occurredAt": "2026-08-25T09:14:22.418Z",
"who": { "sub": "usr_4c81", "role": "RADIOLOGIST",
"org": "usz-radiologie", "mfa": "FIDO2" },
"what": { "resource": "DocumentReference/doc_9a12",
"version": 3, "fields": ["content", "context"] },
"where": { "ip": "193.5.54.0/24", "geo": "CH-ZH",
"channel": "PORTAL", "devicePosture": "MANAGED" },
"why": { "basis": "CARE_RELATIONSHIP",
"purposeOfUse": "TREATMENT", "consent": "GRANTED" },
"changed": null,
"decision": "PERMIT",
"signature": "ecdsa-p384:MEUCIQD…f0Aa"
}Eight views your
DPO opens on Monday.
Administrators, data protection officers and security teams work from the same ledger, filtered to what each of them is accountable for.
Access logs
Every read, write, export and refusal, filterable by patient, practitioner, department, resource class and time window.
Security events
Failed authentications, policy denials, integrity failures, unusual export volumes and break-glass invocations in one queue.
Permission changes
Who granted what to whom, when, and on whose authority — with the prior policy state retained for comparison.
Data exports
Every bulk extraction, its requester, its stated purpose, its record count and its destination. Exports are the highest-risk event class.
Failed logins
Rate, source, targeted accounts and credential-stuffing signatures, with automatic lockout and notification thresholds.
Suspicious activity
Behavioural baselines per role. A coder reading 400 records at 03:00 looks different from a coder reading 40 at 10:00.
Audit reports
Scheduled or on-demand reports for clinical governance, internal audit and the board, in PDF and machine-readable form.
Compliance reports
Pre-built evidence packs mapped to FADP articles, HIPAA safeguards, ISO 27001 controls and SOC 2 criteria.
How the chain
actually works.
- Structure
- Append-only log. Each entry contains the SHA-512 hash of its predecessor, forming a chain from tenant creation to the present event.
- Signing
- Entries are signed with an HSM-held key using ECDSA P-384. Signature verification is available to customers and to their external auditors.
- Tamper evidence
- Editing or removing any historic event invalidates every hash after it. The chain head is published daily so customers can verify continuity independently.
- Write ordering
- The audit entry commits before data is released to the caller. An access that returns data but leaves no record is not an outcome the system can produce.
- Latency cost
- Median 6 ms added per authorised read. Auditability is a design constant, not a feature customers switch off for performance.
- Retention
- Tenant lifetime plus 10 years. Audit events are excluded from routine deletion and from data-subject erasure, as permitted under FADP Art. 6.
- Export formats
- FHIR AuditEvent, CEF, JSON Lines and CSV. Streaming via syslog-TLS, HTTPS push or Kafka to your own collector.
- SIEM targets
- Certified connectors for Splunk, Microsoft Sentinel, IBM QRadar and Elastic. Generic syslog-TLS for everything else.
The documents auditors
ask for, pre-built.
Compliance work is mostly evidence assembly. MediVault generates the packs against your live configuration, so what you hand over reflects the system as it actually runs — not as it was documented two years ago.
FADP evidence pack
Records of processing, technical and organisational measures, sub-processor register and Art. 8 security documentation, generated against your live configuration.
HIPAA safeguards report
Administrative, physical and technical safeguards mapped to your tenant, with the signed Business Associate Agreement attached.
ISO 27001 control mapping
Annex A controls mapped to MediVault features and to the shared-responsibility boundary, for your own certification scope.
Data-subject request pack
For a named patient: the complete record, the full access history, all consents and every disclosure — assembled in minutes, not weeks.
Incident evidence bundle
For a defined time window and record set: every relevant audit event, signed and verifiable, in a form suitable for the EDÖB or a court.
Board assurance summary
A quarterly one-page position on access volume, anomalies, break-glass usage and outstanding review items, written for non-technical governance.
Bring your
security questionnaire.
Send the questionnaire your procurement process requires. We complete it in full, in writing, with evidence references — before any commercial conversation.
SOC 2 Type II report and pen-test summary available under NDA