Engagement isolation
Dedicated AWS infrastructure and customer-scoped configuration separate engagements. Account ownership and operator permissions are agreed before deployment.
Security & shared responsibility
Controls you can inspect.
Responsibilities you can agree on.
A credible security conversation starts with the deployment, the data paths, and the evidence. We review those details with your imaging, infrastructure, and compliance teams.
The approach
Isolation, access, encryption,
and evidence.
Identity & roles
OIDC and role controls protect web interfaces and APIs. Classic DICOM and HL7 paths rely on their configured connectivity and access controls; they are not OIDC interfaces.
Protected data paths
KMS-backed storage encryption, HTTPS, database TLS, and mTLS for meshed services. Classic DICOM/HL7 require an approved secure transport path. Coverage is reviewed per deployment.
Reviewable evidence
Application and platform logs, reconciliation reports, integrity attestations, and a destruction record support review. Retention and Object Lock controls are configured for the relevant stores.
Decommissioning
Customer authorization.
A documented exit.
The authorization key
is an approval control.
Routine Lightbridge teardown is gated by the customer’s Decommission Authorization Key after reconciliation and signoff. The delivery tooling also has an audited emergency operator path. The authorization key and the AWS encryption key serve different purposes.
Key deletion has a lifecycle.
Disabling a KMS key is reversible. Scheduled deletion has an AWS waiting period. Cryptographic erasure depends on completed deletion of the relevant key material and the treatment of every data copy.
Locked evidence, backup retention, legal holds, and residual resources are handled in the agreed plan. We do not equate stopping compute with instantly erasing every record or ending every cost.
Incident recovery
Integrity checks support recovery.
They don’t establish malware safety.
A newly provisioned, segmented environment reduces reliance on the affected archive. It still needs approved connections to your systems, and the trust of those systems must be assessed by your incident-response team.
Skyward reconciliation checks transfer completeness; optional content checks compare image data. Farsight examines configured integrity signals. Neither product is a malware scanner or a guarantee that a returning dataset is safe from every threat.
HIPAA program support
Review the controls
in your operating context.
The repos include a HIPAA controls mapping and risk-analysis material. These support a review of safeguards and shared responsibilities; they do not constitute a compliance certification.
Required BAAs, access policies, transport security, audit coverage, retention, and the customer’s acceptance criteria must be agreed and verified before handling patient data. No diagnostic viewer is supplied.
Let’s make it concrete
Bring the hard questions.
We’ll walk through the controls, known deployment dependencies, and evidence your team needs before approving a pilot.