Security and compliance
Each organisation’sdata stays its own.
Roles, an audit trail and versioned results are part of the product. This page says what exists today.
Where data lives
Separate by design.
Every record belongs to one organisation, and the database enforces that on each query. Nothing is shared between organisations.
TenancyOne organisation is one tenant. Units and roles sit inside it, and access is checked on every request against your memberships.
RegionHosted on AWS in the US East region. Other regions are not available yet.
EncryptionTLS in transit. Encrypted at rest with managed keys. Databases have no public endpoints.
RetentionSet by your organisation, ten years after case close by default. Erasure needs a second person to approve and is logged.
TrainingCase data is not used to train models. Any future use would be off by default and need your organisation’s recorded agreement.
Access
Roles and gates.
Seeing a case, proposing a step and signing are separate permissions. Agents can propose and cannot sign. Organisation administrators manage people and units and cannot open cases.
Per-unit roles
Two-factor sign-in
Sign-off: person only
Audit
Who did what, and why.
Reads, proposals, approvals and dismissals are logged with the knowledge and pipeline versions in force at the time.
Append-only log
Actor, action, target and time on every entry
Versions recorded where a result was produced
Regulatory stance
Decision support. Not a diagnostic system.
Tulparus suggests where to look and explains why. It does not give a diagnosis and does not act without a person’s sign-off.
Intended useSupport for qualified clinical genetics professionals working up cases that stayed unsolved after first-line testing.
Not intendedDirect-to-patient use, or any clinical decision without clinician review.
ReleasesA new model replaces the current one only after it passes the evaluation gates. Every release is recorded.
CertificationsWe hold no formal certification yet and claim none. Security questionnaires are answered on request.