Security
Isolated by tenant. Authorised per action. Audited always.
Four controls carry the weight: row-level security on every hospital table, a single Tool Gateway for every AI action, consent-gated recordings, and an append-only audit record.
Tenancy at the database
Every hospital table has row-level security enabled and forced, so your hospital's data is separated by database isolation, not only by application code. Request-path code runs as a restricted role that cannot bypass it. Your hospital is bound from the number that rang, never from the caller or the model.
- Deny-by-default policies, tested in CI
- Control plane and hospital plane kept apart
One gateway for every AI action
The language model never touches a database or a vendor API. It proposes a tool call; the Tool Gateway checks the request, tenant, caller verification, permission, policy and idempotency, then executes, verifies the result and records it, or refuses. Refusals are recorded with their reason and shown on the call page.
- The AI never controls tenant, verification status, recording, retention, referral selection or pricing
- Failing-path tests on the pipeline
Recording consent and transcript access
The greeting announces the recording. Playback, download, verbatim transcript viewing and QA review are permission-gated in every environment, including for platform staff. Transcripts are emailed only to recipients the hospital configured, never to addresses given on the call.
Recording permissions
Hospital adminAppend-only audit
Every decision on a call, including the ones the gateway refused, is written to an append-only record with its evidence. Hospital staff see it on the call page; platform operators see the same record for support, with media excluded unless separately approved.
| Time | Event | Decision |
|---|---|---|
| 9:02:14 | Caller identified | matched |
| 9:02:31 | Emergency check | no match |
| 9:03:40 | Appointment booked | written and verified |
| 9:03:41 | Confirmation text | queued, STOP checked |
| 9:05:02 | Transfer | refused, not requested |
The emergency-safety floor
Safety is the fifth control. A vet-approved keyword floor runs deterministically on every turn, the model may only raise it, uncertainty fails toward escalation, and a transfer counts only on positive acceptance. A hospital that has approved it can have an emergency caller booked into an emergency exam during open hours; after hours the caller hears the hospital's approved instructions.
- No silent return from an emergency path to routine booking
- Emergency facilities read by name, address and phone
Sample illustration of the emergency path