SALVEA

Security & compliance

Security & compliance

SALVEA runs inside the hospital, on hardware the hospital controls, and patient data does not leave unless the hospital approves it. Every use of AI is recorded, and nothing is filed or sent without a named clinician.

Deployment

  • Single tenant: each institution runs its own copy, inside its own network boundary.
  • Compute runs on CRATON, the institution's own hardware, at four tiers: bedside edge, unit node, hospital server room and provincial data centre.
  • A cloud endpoint is used only after an explicit, recorded approval that names the approver, the purpose and the date.

Data handling

  • Zero egress by default: nothing leaves the institution unless a policy allows it.
  • Every outbound request is counted as one of three: allowed to an approved endpoint, blocked by policy, or unaccounted; any unaccounted request is shown, not hidden.
  • Records are retained under the institution's retention policy.
  • What may be sent to a cloud endpoint is set per model, in that model's data policy.

Audit

  • Every message, retrieval, model call, held action and approval is recorded as an event.
  • Events are append-only and linked in a per-day hash chain, so any later change is detectable.
  • Any date range can be verified against the chain.
  • Each export (JSON or PDF) writes a ledger row with the file's SHA-256 fingerprint before it is handed over.

Human in the loop

  • Sensitive actions are held until a named person approves them.
  • Clinicians can request a second opinion; governance priorities need a recorded sign-off.
  • Nothing is filed to the chart or sent outside without a named clinician.

Model governance

  • Every model is listed in a registry with its version, supplier, deployment and data policy.
  • Evidence gate: automatic routing will not use a model without a passing evaluation and a recent health check.
  • A new version is promoted only with a short what-changed note and a named approver.
  • Clinicians see a notice in chat when a model they use changes, and a previous version can be reinstated the same way.

Privacy review support

  • The evidence pack is a one-click export for a privacy impact assessment (PIA).
  • It covers data flows, outbound requests, retention, the model inventory, the role matrix, and a mapping of controls to FIPPA, PIPA, PHIPA and HIPAA.

Integration

  • Launches from inside the electronic health record using SMART on FHIR (Fast Healthcare Interoperability Resources), the standard app-launch method.
  • Tested against public FHIR test environments; live connection to a hospital's EHR needs the vendor's application id.
  • Works with any model that speaks standard endpoints.