Security questions, answered

Who can access our data, and how is that controlled?

Access is least-privilege, individually attributed and logged. Administrative access is broken-glass only, time-boxed, reason-recorded and visible to the hospital in DM-3. The authentication and access-control disclosure sets out the model in full, and the audit-logging disclosure sets out what is recorded and for how long.

A cited document marked with a padlock opens once an administrator approves your access request; the NDA tier also needs the mutual NDA on record.

Are you ISO 27001 or SOC 2 certified?

No. Pensieve holds no ISO 27001 certificate, no SOC 2 report, no HITRUST certification, no CE marking and no ARTG listing. What exists instead is an ISO 27001 Statement of Applicability without certification, a self-assessed CAIQ, a published policy set, an SBOM, and the security grades for this site, all public and listed on the Assurance page.

Where is our data stored?

It depends on the deployment model, and the answer differs materially between them. DM-1 and DM-2 run in Google Cloud, defaulting to asia-south1 (Mumbai) with the region selectable. DM-3 runs in the hospital's own cloud project, in whatever region the hospital chooses. DM-4 runs on the hospital's own hardware, in the hospital's own building. Pensieve stores nothing.

A cited document marked with a padlock opens once an administrator approves your access request; the NDA tier also needs the mutual NDA on record.

What happens to our data if we leave?

The Exit and Data Portability Commitment is published and binding. It specifies the export format, the delivery timetable, the retention period after termination and the certificate of deletion issued at the end of it. It is public precisely so it can be read before signature rather than discovered at termination.

A cited document marked with a padlock opens once an administrator approves your access request; the NDA tier also needs the mutual NDA on record.

How quickly do you notify us of a security incident?

Within the timeframe set by the applicable law and the SLA, whichever is shorter, measured from the point of confirmation rather than the point of convenience. The incident response and breach notification disclosure sets out the escalation ladder, the notification contents and the regulator path per jurisdiction.

A cited document marked with a padlock opens once an administrator approves your access request; the NDA tier also needs the mutual NDA on record.

Is Pensieve ABDM certified?

No, deliberately. The hospital is the registered health facility: it holds its own HFR facility ID, its clinicians hold their own HPR IDs, and it holds its own NHCX participant credentials. Pensieve operates a bring-your-own-credential model and calls those systems as the hospital, on the hospital's own authority. Pensieve is therefore not the regulated participant and does not represent that it is. This is an architectural boundary, not a gap.

A cited document marked with a padlock opens once an administrator approves your access request; the NDA tier also needs the mutual NDA on record.