Security and data handling
Customers upload clinical protocols, client files and internal policies. These are the specific measures that protect them.
Organizations are separated in the database
Every record belongs to an organization, and access is decided by row level security in Postgres rather than by a filter in application code. A query that forgets its organization filter returns nothing, instead of returning somebody else’s data.
Participants have no path to the case
Hidden case detail, character instructions and marking guidance are not restricted from participants, they are unreachable. A participant reads a briefing view built from the columns they are meant to see. There is no query, endpoint or parameter that exposes the rest.
Documents stay private
Uploads go straight from the browser into private storage and are never public. When a simulation shows a participant an image, the server checks the session is live, belongs to them, and that the item is attached to the scenario running, then issues a link valid for ninety seconds for that one object.
The character cannot name its sources
Retrieved passages reach a simulation stripped of provenance. There is no file name, document title, section heading or page number in what the character receives, so there is nothing for it to disclose even under direct questioning. Provenance stays available to your administrators in a separate, authenticated view.
Instructions cannot be talked around
The rules keeping a character in role are composed above scenario content and cannot be overridden by an author, by an uploaded document, or by a participant. A document that contains the words "ignore your instructions" is treated as text to be read, not as a command.
Credentials stay on the server
The browser never holds a key for the voice provider and never receives the session configuration. The application server authorises each connection, composes the session, and exchanges the connection details on the participant’s behalf.
Access is time bound
A session has an availability window, a duration and an attempt limit, checked on every connection rather than only when the page loads. Outside the window the simulation does not open.