Patient Data Vault. The record of record.
One authoritative, tamper-evident home for every clinical record your organisation holds — encrypted before it is written, sharded across independent domains, versioned on every change, and erasable only in ways you can prove.
- Encryption
- AES-256-GCM
- Storage shards
- 3×
- Key custody
- HSM L3
- Residency
- Switzerland
A vault is defined by
what it refuses to open for.
Encryption is the easy part. What makes a vault a vault is that every attempt to open it is authorised against a policy, recorded before anything is released, and provable afterwards to somebody who was not in the room.
- AES-256
- GCM envelope encryption
- 3×
- Independent storage shards
- FIPS L3
- HSM key custody
- 20 yr
- Statutory retention floor
What actually goes
into the vault.
MediVault is not a document dump. Each data class has its own schema, retention rule, access profile and audit treatment — because a lab result and an insurance letter are not the same kind of secret.
Medical records
Structured encounters, diagnoses, medications, allergies
Clinical documents
Discharge letters, consultation notes, operative reports
Diagnostic reports
Radiology, pathology and cardiology reporting
Imaging metadata
DICOM study index and pointers; pixel data stays in PACS
Laboratory information
Orders, results, reference ranges, LOINC-coded panels
Referral documents
Inbound and outbound referrals with routing history
Treatment records
Care plans, procedures, therapy and follow-up schedules
Patient forms
Consent, intake, questionnaires and signed declarations
Insurance documentation
Coverage confirmations, guarantees, claim attachments
Administrative records
Identifiers, contact data, correspondence, mandates
Six stages, from arrival
to cryptographic erasure.
Every record in MediVault moves through the same six stages. There is no fast path, no unencrypted staging area and no administrative override that skips a step.
Ingest
Records arrive via FHIR, the portal, an EHR connector or bulk migration. Every write is validated, classified and assigned a retention class before it is sealed.
Seal
A unique AES-256-GCM data key encrypts the record. That key is wrapped by your tenant master key, which never leaves the HSM in plaintext.
Shard
Ciphertext is split across three independent storage domains, each carrying its own integrity hash. No single domain holds a reconstructable record.
Serve
On an authorised read, shards are gathered, integrity-verified, reassembled and decrypted. A failed hash triggers reconstruction and a security event.
Version
Writes never overwrite. Each change creates an immutable new version, with the prior version retained and a signed before/after diff in the audit ledger.
Retain or erase
Retention classes enforce Swiss statutory minimums. When a period expires and no legal hold applies, keys are destroyed — cryptographic erasure, verifiable and irreversible.
The vault your
patients trust.
MediVault is purpose-built for healthcare data — not adapted from a generic cloud storage service. Every architectural decision reflects the sensitivity of medical records and the legal precision of Swiss data law.
AES-256 Encryption at Rest
Every patient record encrypted before write. Keys managed via HSM-backed infrastructure hosted in Zurich.
Immutable Audit Trail
Cryptographically signed access logs. Every read, write, and deletion is permanently recorded and tamper-proof.
Zero-Knowledge Architecture
We never hold plaintext keys. Decryption happens client-side. Your data remains inaccessible even to MediVault staff.
HL7 FHIR Compatible
Full FHIR R4 API support. Integrate with existing EHR systems in days, not months.
Swiss Data Residency
100% data residency in Switzerland. Tier-IV data centres in Zurich with N+1 redundancy and sub-10ms failover.
Granular Access Control
Role-based access with attribute-level permissions. Grant a radiologist access to imaging data only — nothing more.
Encryption is the easy part.
Proving nothing changed is not.
Confidentiality stops the wrong people reading a record. Integrity proves the record they read is the record that was written. Clinical safety depends on the second one at least as much as the first.
Per-shard hashing
Every shard carries a SHA-512 digest checked on each read. Silent bit-rot and tampering are detected, not assumed away.
Continuous scrubbing
A background verifier walks the entire corpus on a rolling 14-day cycle, re-hashing shards and repairing from redundancy before anyone notices.
Version chaining
Each record version commits to the hash of its predecessor. Rewriting history requires forging every subsequent version.
Independent backup
Encrypted backups to a separate Swiss facility on a 15-minute RPO, restore-tested quarterly with results published to customers.
No plaintext at rest
Plaintext exists only in process memory during an authorised operation. It is never written to disk, cache, log or temp file.
Sub-processor isolation
Storage providers hold only encrypted shards and never hold keys. Compromising a storage vendor yields ciphertext.
Swiss law says keep it.
Patients say delete it.
Both are true, and a vault that cannot hold that tension is not fit for healthcare. MediVault resolves it with retention classes, legal holds and cryptographic erasure that satisfies an auditor and a data-subject request at the same time.
- Clinical records (CH)
- 20-year minimum retention under Swiss medical record obligations, configurable upward per canton and per record class.
- Imaging metadata
- Retention aligned to the linked PACS study. MediVault will not orphan an index whose underlying study is still retained.
- Audit events
- Retained for the life of the tenant plus 10 years. Audit events are never subject to routine deletion — only tenant termination with contractual sign-off.
- Legal hold
- A hold suspends every deletion rule on matching records, is itself an audited action, and requires named authorisation to place or lift.
- Cryptographic erasure
- Destroying the record's data key renders every shard and every backup copy permanently unreadable — including copies already written to offline media.
- Data export on exit
- Full FHIR R4 bundle plus original documents, delivered within 30 days of a termination notice. Your data leaves in a format your next system can read.
See it hold
your own records.
We will run a migration dry-run against a de-identified extract of your existing system, and show you the resulting vault, audit trail and retention profile before you commit to anything.
Typical clinic go-live: 3 days · Typical hospital migration: 6–10 weeks