This is the apex information security policy of Edsol Edtech Pvt. Ltd. Every other policy in the POL-GL-1xx series is subordinate to it. It is approved by the Founder and it is published in…
POL-GL-100PolicyGL1234Public
Search all 478 artefacts by title, document ID or content.
The register
491 artefacts, 12,07,999 words, classified on five independent axes and versioned. 108 of them are public and open in one click; 228 sit on the critical path to cash.
Documents you cannot open yet are still listed, with the gate, the action that clears it and how long that takes. Hiding them would only make you send an email, and an email costs a day.
A further 109 artefacts are classified Internal and are not listed here. They describe how Pensieve runs itself rather than how it treats your data. The count is published because concealing it would be the same mistake in a smaller costume.
This is the apex information security policy of Edsol Edtech Pvt. Ltd. Every other policy in the POL-GL-1xx series is subordinate to it. It is approved by the Founder and it is published in…
Read this before you sign, not before you go live. This document exists to prevent the most expensive surprise available in hospital software: discovering at cutover that a regulatory…
The Australian fork of DIS-GL-029 and the Australian analogue of the integration boundary published for India (DIS-GL-024). This document is the honest conformance answer. It states what is…
Applies to DM-1, DM-2, DM-3 and DM-4 identically. The same application code and the same standards support ship in all four models.
Three distinct things are managed here and are never conflated: encryption keys protecting data at rest; Edsol Edtech Pvt. Ltd. secrets used to run the Platform; and hospital-supplied…
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: target 4 business hours
The configuration in this document is the answer to a specific Indian legal obligation that the cloud defaults do not satisfy out of the box. A reviewer should treat it as a configuration…
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: target 4 business hours
DIS-GL-013 describes what a hospital can query itself. DIS-GL-034 carries the log retention and localisation configuration in full. This policy states the internal rules.
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: target 4 business hours
Sections 2 to 5 describe what a hospital needs on its own floor in every deployment model. Sections 6 and 7 add what the hospital additionally owns in DM-3 and DM-4.
DM-2 is the hardest deployment model to defend to a hospital IT committee, so it is documented in more detail than the other three and its limitations are stated before its controls.
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: target 4 business hours
To show a hospital's IT reviewer every point at which hospital data crosses a boundary, in each deployment model, without disclosing internal hostnames, IP ranges, service account…
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: target 4 business hours
This policy is public and therefore states rules, not topology. The sanitised network and data-flow diagram is DIS-GL-006 (public); the detailed diagram with internal names is DIS-GL-007…
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: target 4 business hours
Two populations, kept entirely separate, with different rules. DM-1 to DM-4 do not vary Section 3 (Pensieve Labs personnel). Section 4 (hospital users) describes Platform capability, which…
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: target 4 business hours
This document is for the person who has to decide whether Pensieve can be operated safely inside a hospital: the IT head, the group CIO, the incumbent maintenance partner, or an external…
Read this first. A security claim that is true for DM-1 can be false for DM-4. Every section of this document that is deployment-model-sensitive carries a per-model table or a variant note.…
This file carries two addressable documents:
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: target 4 business hours
Edsol Edtech Pvt. Ltd. does not operate a data centre. It does not own, lease, share or have physical access to any facility in which hospital data is stored. Almost everything in this…
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: target 4 business hours
The honest position first. Edsol Edtech Pvt. Ltd. operates no data centre. For DM-1, DM-2 and DM-3, physical and environmental security of the infrastructure is provided by the cloud…
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: target 4 business hours
This document is the index to Edsol Edtech Pvt. Ltd.'s internal information security policy set. It states what policies exist, who owns each one, how often each is reviewed, how exceptions…
POL-GL-134 governs the specific case of access to production data, including break-glass. This policy governs privileged rights generally: cloud administration, repository administration,…
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: target 4 business hours
This is the control a hospital should interrogate first. Everything else in the policy set assumes that Pensieve Labs personnel cannot casually reach patient data. This document states how…
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: target 4 business hours
Edsol Edtech Pvt. Ltd.'s record of the processing it carries out as a Data Processor on behalf of hospitals. In GDPR jurisdictions this is the Article 30(2) processor record and a…
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: target 4 business hours
The question this document answers: who can see our data, from where, under what controls, and can we stop them? It is the control on which every other control in this Trust Center depends,…
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: target 4 business hours
The Australian fork of DIS-GL-033. This document exists because Australia contains the one constraint in Pensieve's portfolio that a contract cannot solve, and because a hospital that…
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: target 4 business hours
Applies to all Personnel in every deployment model. Where a hospital contractually restricts support to personnel located in a named jurisdiction, that restriction is recorded on the Order…
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: target 4 business hours
To keep hospital data off portable media, and to control the narrow set of circumstances in which media is unavoidable.
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: target 4 business hours
This is Pensieve Labs's statement of how it thinks about artificial intelligence in a hospital. It is the principles document that produced the two operational documents beside it, and it…
Applies in all four deployment models. The risk profile differs sharply by model: DM-2 carries tenant-isolation risk, DM-4 carries patching and detection risk that sits with the hospital,…
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: target 4 business hours
Why this document is the only one in the policy set that is not public. A hardening standard states the exact configuration of the defences. Publishing it hands an attacker a map of what to…
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: target 4 business hours
Applies to DM-1, DM-2, DM-3 and DM-4 identically. The same application code runs in all four deployment models, built by the same pipeline from the same repository. What differs is where it…
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: target 4 business hours
DIS-GL-018 is the customer-facing description of the pipeline. This policy is the binding internal rule set. Branch protection detail is POL-GL-133; release approval is POL-GL-107.
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: target 4 business hours
Applies to all Personnel in every deployment model. Training for hospital staff on using Pensieve safely is a separate programme delivered under RBK-GL-016 and certified in CRT-GL-005; this…
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: target 4 business hours
The honest position, first. Edsol Edtech Pvt. Ltd. is a small company. Full segregation of duties between development and operations is not achievable at this size and Pensieve Labs does…
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: target 4 business hours
There is one codebase deployed into four deployment models. This policy applies identically to DM-1 through DM-4. Escrow (Section 4.8) is the mechanism by which a hospital in any model…
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: target 4 business hours
Applies to DM-1, DM-2, DM-3 and DM-4. The log records changes to the Subprocessor Register (DIS-GL-009); which entries are relevant to a given hospital depends on its deployment model, and…
The Subprocessor Register (DIS-GL-009) is the source of truth for who the sub-processors are. It is public, dated and live; this policy does not list them and never will, because a list in…
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: target 4 business hours
Section 3 (Trust Center and corporate) applies in all four models, because every hospital that buys Pensieve also uses the Trust Center to receive documents, and no deployment model changes…
Applies to DM-1, DM-2, DM-3 and DM-4 identically. The same artefact is deployed in all four models, so the bill of materials for a given release is the same in all four. In DM-4 it is the…
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: target 4 business hours
This is the register. Where any other Pensieve Labs document describes what assurance exists, this document is authoritative and more current. It is reviewed quarterly and re-dated in…
A percentage without a measurement method is not a commitment. This document publishes the method; the commitment itself is in SLA-GL-001 and on the Order Form.
Vendor and sub-processor are not the same thing. A vendor is any third party Edsol Edtech Pvt. Ltd. engages. A sub-processor is a vendor that processes customer personal data, and carries…
Accept the mutual NDA to request access to this tier. Your acceptance is recorded at once and protects both sides; an administrator then grants access, with a target of four business hours.Accept the mutual NDAWait: target 4 business hours