Security & compliance
How patient data is protected
Written for the hospital IT lead who has to sign this off, and for the auditor who will ask about it. Specifics, not adjectives.
01 Controls
Six controls, and what each actually does
Each of these is a mechanism rather than a policy — something that can be pointed at in the code and demonstrated to an auditor.
- In transit
-
TLS, then Fidelius on top
TLS 1.2 and 1.3 only, with HSTS preloaded. Health information between providers is additionally sealed with Fidelius — Curve25519 key exchange, HKDF-SHA256, AES-256-GCM — so the gateway itself never sees plaintext.
- At rest
-
Field-level, with a blind index
Client secrets, ABHA numbers and addresses, mobile numbers, session tokens and ephemeral private keys are encrypted field by field with rotating keys. Searchable fields use a blind index, so the plaintext never enters a query.
- In the logs
-
Redacted before the line is written
A redaction layer blanks OTPs, Aadhaar numbers, tokens, ABHA numbers, contact details and bundle content before any log line is written — including inside stack traces.
- Consent
-
Scope enforced on every release
Records are selected by facility, patient, HI type and the intersection of the consent window with the request window. A revoked artefact stops working immediately, checked again when a received bundle is read.
- Access
-
Scoped credentials, rotating sessions
Scoped API credentials per application and environment. Two-factor authentication required for organisation owners and platform staff. Refresh tokens rotate, and reuse of a spent one revokes the whole session family.
- Retention
-
Purged on the artefact’s own date
Records received under consent carry the erasure date from the artefact and are purged automatically when it passes — so a deleted artefact cannot orphan its data.
02 Isolation
One customer cannot reach another’s data
Multi-tenancy is the control most often asserted and least often enforced. Here it is enforced in the data layer, below the code that serves a request.
- Scope
-
Every query is organisation-bound
Queries are scoped to the authenticated application’s organisation. One customer cannot read another’s patients, care contexts, consents or audit events, and there is no endpoint that returns across tenants.
- Proof
-
Tested by trying to break it
The isolation is covered by tests written specifically to cross the boundary — reading another tenant’s object by id, by reference, and through every relation that could reach it.
- Trace
-
One id, end to end
Every API request, every ABDM transaction and every consent decision is recorded with a correlation id. One identifier traces a record request from your software, through ABDM, to the provider and back.
- Keys
-
Separated by environment
The environment is a property of the credential rather than of the URL. A sandbox key cannot reach production data, and swapping to production is a credential change rather than a code change.
03Regulatory position
The platform is built to the ABDM Health Data Management Policy and the Digital Personal Data Protection Act 2023. For patient data you send us, you are the data fiduciary and we are a data processor acting on your instructions; for your own account details, we are the fiduciary.
Data is stored and processed in India, and sub-processors are limited to infrastructure providers operating in Indian regions. Patient data is not transferred outside India.
04The WASA audit
Production access on ABDM requires a Web Application Security Assessment by a CERT-In empanelled auditor and a Safe-to-Host certificate. STQC and internal audits are not accepted.
That assessment applies to the integrating entity — it is your audit, not ours — and we build to pass it. Where a finding lands on the connector rather than on your application, remediation is ours and does not consume your audit window.
05Reporting a vulnerability
Email abdm@swastik.ai with steps to reproduce. We will acknowledge within two working days.
Please do not test against another organisation’s data — ask us for a sandbox tenant and we will set one up, which gives you a real target and costs a hospital nothing.