Feature

Backups carry patient data. We treat them that way.

Agent to console traffic is signed with HMAC-SHA256 and protected against replay. Database and storage credentials are stored with AES-256-GCM encryption, or kept only on the client server when local credential mode is selected. Every configuration change is written to an audit log.