Security architecture

This page covers the same material as the Security page, at reviewer depth.

The data boundary

Ivren reads interface configuration and message structure on the customer’s machine. There is no telemetry, no account, no phone-home. Passwords found inside imported exports are stripped at import and reported for rotation — they never render in the UI. The message archive, when the engine runs interfaces, is the only component holding raw message content; it lives on customer-managed storage with customer-held encryption keys.

The AI boundary

AI features are optional, off by default, and require the customer to supply their own model API key. What may cross to a model: run metadata, counts, field paths, tokenised values, verdicts. What may never cross: raw or partial message content, untokenised values, free-text clinical fields — enforced by two independent gates that both fail closed.

Signing

Licenses, gate decisions, and releases are signed with domain-separated keys: a signature issued for one purpose can never verify as another.

Audit

Hash-chained, append-only audit logging with tamper detection, behind a closed role set (admin, engineer, operator, revenue, auditor) enforced server-side. Every sensitive view and change is recorded.