Security overview

Deployment model

• On-premises. PrismLink is installed on a server owned and controlled by the healthcare organization, inside its own network, alongside the imaging and reporting systems it connects. There is no multi-tenant or vendor-hosted deployment.
• Windows service. Components run as supervised Windows services under a service account chosen by the site. A Group Managed Service Account (gMSA) is the recommended identity, so no service password is stored or manually rotated. Running as LocalSystem or as a named person is not recommended.
• No inbound access from outside the organization is required for normal operation.

What data PrismLink receives

• DICOM Structured Reports from imaging modalities, and HL7 ORU result messages from information systems. Both contain protected health information — patient identifiers and clinical measurements.
• Report field values written to the reporting system, and — where a site enables it — signed report text retrieved from the reporting system for validation purposes.
• PrismLink does not require, and does not request, data beyond what is needed to map and deliver the study.

How data is persisted

• Received documents are retained. Each received DICOM SR or HL7 message is written byte-for-byte into a content-addressed archive on the local filesystem, under the program data directory. Originals are never modified in place.
• Two local databases. An authoritative store holds study identity, configuration decisions and delivery state; a second, rebuildable cache holds derived analysis. Both use embedded SQLite — there is no separate database service to deploy or secure.
• Both the archive and the databases contain PHI and should be treated accordingly: restricted ACLs, excluded from general-purpose file shares and from workstation backup scope.
• Encryption at rest is provided by the host, not by the application. PrismLink does not encrypt its own database files or archive. Deployment guidance is to place them on an encrypted volume (for example BitLocker). Application-level encryption at rest is [In progress] — if your policy requires it rather than volume-level encryption, tell us during evaluation.
• Retention. Received studies and decision history are retained indefinitely by default so that any delivered value remains auditable. A configurable retention and purge policy is [In progress]; today, retention is managed by the site.

Network communications

Inbound

• DICOM receiver and HL7 MLLP listener, on ports chosen by the site, reachable only from the modalities and systems the site permits. These are installed only for deployments that perform live delivery.
• Studio, the browser configuration interface, is served by the application itself and binds to localhost by default. Exposing it beyond the host is a deliberate configuration change, and the software warns — or, with PRISMLINK_AUTH_STRICT set, refuses to start — if it is bound off-loopback without authentication enabled.

Outbound

• To the reporting system, to deliver field values. This carries both the application credential and PHI, and runs over HTTPS with the server certificate verified against the system trust store by default. Sites using an internal certificate authority supply their CA bundle. Disabling verification is possible but is an explicit, logged opt-in intended for isolated test endpoints, and is not appropriate for production.
• To the update service, to check for and download signed software updates over HTTPS. No study data is transmitted.
• To a language-model provider — during configuration only. See below.

The one external data flow, stated plainly

During setup, PrismLink can use a language model to propose how a particular scanner's encoding maps onto report fields. To make that proposal, the contents of structured reports from that scanner are sent to the model provider.

• This happens during configuration and review, not during live study processing. Once a mapping is accepted it is executed by local, deterministic code, and no external service is contacted to deliver a study.
• Every proposal is reviewed and accepted by a person before it takes effect.
• Structured reports can contain patient identifiers as well as measurements. Sites that require it can operate this step under an agreement with the model provider covering protected health information, and Circanever Technologies maintains the corresponding agreements for its own use. [In progress] — reducing what is transmitted during this step to the minimum necessary is active engineering work, and the current state for a given release will be stated in writing during evaluation.
• A site that does not wish to use model-assisted configuration can have mappings configured manually; the resulting runtime behaviour is identical.

Authentication and access control

• Studio access supports three modes. Open, appropriate only for the default localhost bind. Proxy, the intended production mode, in which an authenticating reverse proxy such as IIS performs Windows Integrated Authentication against Active Directory and PrismLink authorises against a named AD group. Basic, a single-account fallback.
• Human access is intended to be gated by an AD group, so that joining and leaving is managed by existing hospital identity processes rather than by local accounts on the server.
• Credentials are never stored in the application tree. The reporting-system password and any API keys resolve through a chain of environment variable, then the operating system's secure store (Windows Credential Manager), then a protected file. Secrets are never written to logs; a lookup failure reports where it looked, not what it found.
• Role-based access control within Studio — distinguishing, for example, a reviewer from an administrator — is [In progress]. Today, access to Studio is access to configuration.

Audit and logging

• Configuration decisions are append-only. Every mapping decision records the actor, the time, and what was decided. Later automated runs cannot silently overwrite a human decision, and superseded proposals are retained rather than replaced.
• Received studies carry an append-only status history — received, processing, processed, held, failed — so the handling of any document can be reconstructed.
• Delivery is tracked to acknowledgement. Each delivery attempt moves through a durable spool; failures are retained for inspection rather than discarded.
• Update history is recorded, including what was installed, when, and by which operator action.
• Operational logs avoid clinical content. The engineering standard is that logs identify studies by accession and technical identifiers rather than reproducing patient names or clinical values. [In progress] — a formal log-content review and a documented log retention policy are not yet complete.
• Forwarding audit records to a hospital SIEM is [In progress]; today the records are local.

Backup and recovery

• PrismLink provides an explicit backup command that produces a consistent copy of its databases; the destination must be named deliberately, so a backup cannot be written to an unintended location by default.
• Because received documents are retained immutably and derived data is rebuildable, the cache can be discarded and regenerated without loss of decisions or source material.
• Software updates back up the existing installation before replacing it and can be rolled back.
• Backup scheduling, offsite copies and restore testing are the site's responsibility and should be included in the deployment plan. A documented recovery objective is [In progress].

Software integrity and updates

• Updates are distributed as packages whose manifest is signed with an Ed25519 key held offline. The corresponding public key is pinned into the installation and is never taken from the update server.
• The distribution server is treated as untrusted infrastructure. It serves bytes; it cannot authorise an installation.
• A package is verified before extraction, copied into immutable staging, and verified again there. Release sequence numbers only move forward, so a superseded release cannot be re-offered.
• Checking, downloading and installing are separate operator actions. PrismLink does not install updates automatically.

Remote access and telemetry

• PrismLink contains no remote access mechanism. There is no built-in remote console, no reverse tunnel and no vendor backdoor. Any support access is arranged through the site's own remote-access process, under the site's control and supervision.
• PrismLink collects no telemetry or analytics. It does not report usage, performance or error data to the vendor. Diagnostic information reaches Circanever Technologies only when a site deliberately sends it.

Subprocessors

• Language-model provider — receives structured report content during model-assisted configuration only, as described above. Not contacted during live study processing.
• Software update distribution — operated by Circanever Technologies to serve signed update packages. It receives no study data and no protected health information.
• No other third party receives data from a PrismLink deployment. A formal subprocessor schedule for contracting purposes is [In progress].

Determinism and clinical safety posture

• No model participates in processing a live study. Mapping decisions are made and reviewed during configuration and then executed by audited local code.
• The same study produces the same output every time, and that output can be replayed and compared.
• Where evidence is ambiguous, the field is left empty rather than populated with a guess. Empty fields are expected and are visible to the radiologist.
• Automated review of proposed mappings records what it removed and on what evidence, rather than silently discarding it.

What this page does not claim

PrismLink is in alpha and deployed for evaluation. Circanever Technologies makes no claim on this page of regulatory clearance, certification, or third-party audit. Formal security assessment, penetration testing and independent attestation are [In progress]. Questions about the current state of any item above are welcome and will be answered directly rather than deferred to a datasheet.