Built for healthcare data from the first line of code.
Axiom OrderFlow handles EEG order intake for neurodiagnostics departments. Protecting that data — and proving how — is a first-class part of the product. Here is exactly how it works, in terms your IT and security teams can verify.
The controls in place today
Tenant isolation at the database
Tenant-isolation controls are implemented at the database layer (PostgreSQL row-level security scoped to your organization on customer-data tables) and the application layer, and are continuously tested against supported access paths — including cross-tenant reads and writes with leaked record identifiers.
Encryption in transit and at rest
All traffic is TLS/HTTPS. Data at rest is AES-256 encrypted by the managed Postgres platform. Order PDFs sit in a private bucket with no public URLs — streamed only to authorized members of the owning organization.
Role-based access control
Viewer, staff, supervisor, and admin roles are enforced on the server and re-checked in the database on protected routes and data access paths. The interface only hides what a role cannot do; the enforced authority is in the security policies. Role and cross-tenant denial behavior is exercised by automated test matrices.
Governed EHR interfaces
Axiom supports governed HL7 v2 and FHIR R4 interface workflows through a hospital’s interface engine. Each production connection is separately scoped, tested, and accepted with the customer’s interface team. Interface intake is fail-closed and synthetic-only until production activation, idempotent, human-reviewed, and quarantined on failure.
Append-only audit trail
Approvals, edits, deletions, and permission changes are written through audited paths, with core clinical writes committed in the same transaction as their audit entry. The actor is stamped from the server session, not supplied by the client, and the audit table carries no update or delete policy for application users. Deletions keep their history.
Two-step verification (MFA)
Any account can enable TOTP two-factor authentication. Once on, the second step is required before any private page or API responds — enforced in middleware, not just the login screen.
Human approval before recording
AI extraction never writes to the tracker directly. Every field passes a strict validation gate and a human review before it becomes a row. Invalid AI output is routed to manual review, never inserted unchecked.
Least-privilege service access
The privileged service key lives only in server environment — never in a browser. Its use is a short, inventoried list, each independently authenticated; everything a user does runs under their own session.
Controlled data retention
A nightly job purges stored order PDFs older than your configured window, for settled orders only — extracted data, rows, and audit history remain, and each purge is itself audited.
Protected Health Information: a deliberate gate
We are direct about what “HIPAA-ready” means. The engineering controls a HIPAA posture depends on — encryption, access control, audit, isolation, retention — are implemented and listed above. Turning on real patient data is gated behind business and legal steps, in this order:
- 1
Today the platform is restricted to de-identified or synthetic data by contract and by operating practice. A database constraint pins the patient-identifying mode off, and turning it on takes a deliberate, reviewed migration rather than a setting — but that constraint governs the mode flag, not the contents of a field. This release does not technically prevent someone typing patient information into an order, so please do not enter or upload real PHI.
- 2
Before a workspace is authorized for real patient information, Axiom completes signed Business Associate Agreements (BAAs) with its data and AI subprocessors. We describe that as the sequence we follow, not as agreements already in place.
- 3
A security review is completed against your environment, and patient-identifying mode is unlocked through a deliberate, reviewed database migration — never a toggle.
Until those steps are complete for your organization, the product runs on de-identified or synthetic data. We will not claim certification we do not hold, and we will not let real PHI into a workspace before the agreements are signed — that protects your department as much as it protects ours.
Bring your IT and compliance teams.
We welcome security reviews and will walk through the architecture, our subprocessors, and where each stands on a BAA. Found a vulnerability? Report it privately and we will address it before any disclosure.