Secure Portal. Where the work happens.
Cryptography nobody can use is not security, it is theatre. The portal is where clinicians actually meet MediVault — and it has to be fast enough that nobody goes looking for a workaround.
- Authentication
- MFA · SSO
- Decryption
- Client-side
- Accessibility
- WCAG 2.2 AA
- Languages
- DE · FR · IT · EN
Watch encryption
happen live.
Our portal encrypts data client-side before it ever leaves your browser. The terminal below simulates a single patient record write — exactly as it happens in production.
Keys never touch our servers. Derived from your identity token using PBKDF2 with 310,000 iterations.
Authenticated encryption ensures both confidentiality and integrity. Any tampering is detected.
The encrypted payload is sealed with a hardware security module. Physical tamper-evidence guaranteed.
Data is split across geographically separated Swiss data centres. No single point holds a complete record.
The record has to load
before the clinician reaches the door.
Nobody opens the portal from a desk. It opens from a corridor, between rooms, on whatever device is closest — so the interface is designed backwards from that walk, not from a demo environment.
- 38 ms
- Median authorised read
- MFA
- TOTP, FIDO2 or SSO
- Client-side
- Decryption in-browser
- 4
- Interface languages
Eight things clinicians
do every day.
Each of these is available in production today. Where a capability is not built, we say so on this page rather than leaving it implied.
Secure login
Password plus TOTP or FIDO2 hardware key, or a single click through your institutional SSO. Session policy is set by your administrators, not by us.
Patient search
Search by name, insurance number, AHV number, internal identifier or date of birth — scoped automatically to patients you are authorised to see.
Record access
Structured clinical data and documents in one timeline, decrypted in your browser, with the authorisation basis shown alongside each item.
Document upload
Drag-and-drop with client-side encryption before transmission, automatic classification prompts and duplicate detection.
Document download
Watermarked exports carrying the requester, timestamp and purpose of use. Every download is an audited event.
Record sharing
Share a defined record set with a named external provider, with an expiry date, a stated purpose and one-click revocation.
Permission management
Delegate, cover and hand over access to colleagues within the bounds your administrators have configured.
Audit history
See who else has accessed this patient's record, when and why — visible to clinicians, not only to compliance staff.
The record belongs
to the patient.
Patient-facing access is a separate, hardened portal with its own authentication and its own threat model. Two of the six capabilities below are still roadmap, and are labelled as such.
View own records
Patients see their own clinical record through a separate, hardened patient portal with its own authentication.
Download own records
Export a complete FHIR bundle plus original documents — the data-portability right, implemented as a button.
Review access history
Every professional access to their record, with the stated purpose and authorisation basis, including break-glass events.
Grant and revoke access
Share records with a chosen provider and withdraw that access at any time, with revocation effective within 60 seconds.
Access notifications
Optional alerts when their record is accessed, configurable by event type. Off by default to avoid alarm fatigue.
Correction requests
Raise a structured correction request against a specific field, routed to the responsible clinician for review.
Access notifications and correction requests are not built yet. They carry target quarters and are excluded from every plan's feature list until they ship.
What runs
in the browser.
- Cryptography in the browser
- AES-256-GCM decryption via the Web Crypto API. Record keys are unwrapped in-session and never persisted to local storage, session storage or IndexedDB.
- Transport
- TLS 1.3 only, with certificate pinning in the managed desktop build and HSTS preloading for the web build.
- Session handling
- Default 30-minute idle timeout with an absolute cap, configurable per tenant. Step-up authentication for sensitive record classes.
- Clean exit
- Closing the tab wipes decrypted material from memory. No plaintext survives in cache, history or the browser's disk cache.
- Browser support
- Current and previous major versions of Chrome, Edge, Firefox and Safari. Legacy Internet Explorer is not supported and will not be.
- Accessibility
- WCAG 2.2 AA conformance, full keyboard operation, screen-reader tested with NVDA and VoiceOver, and a reduced-motion mode.
- Languages
- German, French, Italian and English, with per-user selection. Clinical content is never machine-translated.
- Offline behaviour
- The portal does not cache clinical data for offline use. On connectivity loss it fails closed rather than serving a stale record.
Put it in front
of your clinicians.
We run guided pilots with a single department: real workflows, synthetic data, and honest feedback from the people who will use it at 07:00 on a Monday.
WCAG 2.2 AA · German, French, Italian and English