Zero-exposure transfer
Studies move directly from source to destination over an encrypted, access-controlled path. Data is never parked in, or routed through, systems that don't need to see it.
The platform
Managed infrastructure for moving PHI.
Connect a clinical institution on one side and a research institution on the other. Clinical institutions and hospitals send imaging for free; research institutions pay $1 per study. Aegis handles encryption, access control, metering, and audit, so neither side builds or maintains the hard parts.
Per-study metering
Sending is free for clinical institutions; research institutions are billed $1 per study delivered, totaled monthly. Every transfer is measured independently, verifiable by both parties, and resistant to over- or under-reporting.
Tamper-evident audit
A cryptographically chained record of every authorization, access, and delivery. Pass an audit by exporting it, not by reconstructing it.
Compliance built in
Designed for deployment in HIPAA-regulated environments, with per-study envelope encryption and Business Associate Agreements in place.
Engineered for scale
Multi-gigabyte CT and MRI volumes are handled as single sealed studies, with integrity verified end to end on every transfer.
Drop-in integration
DICOM-native ingest and a clean REST API. Connect your PACS on one side, your analysis pipeline on the other, and we handle everything between.
How it works
Three steps.
Connect, release, deliver. The security, metering, and audit run underneath.
- 01
Ingest
The clinical institution sends an imaging study to Aegis over an encrypted channel. It's sealed with a per-study key (AES-256).
- 02
Secure relay
Aegis authorizes a precise, time-bound, single-purpose handoff to the approved research institution, and meters it independently as it happens.
- 03
Deliver
The authorized research institution receives the study, integrity-verified to the byte. Billing settles automatically; the audit trail is sealed.
Technical foundations
Standards-based engineering, not a black box.
The proprietary part is how we meter and verify a transfer without ever touching the payload. Everything around it is built on recognized standards, and you can run it yourself in the live demo.
Transport
TLS 1.2+ end to end. DICOM file ingest — single objects or a ZIP of a study, encrypted at the endpoint.
Encryption at rest
AES-256 per-study envelope encryption; keys destroyed on expiry.
Access
Short-lived, scoped, single-purpose signed URLs: least-privilege and time-boxed.
Integrity
SHA-256 checksum verified end to end on every study: sent equals received.
Audit
Append-only, hash-chained, exportable records: tamper-evident and WORM-capable.
Metering
Delivery measured independently of sender and receiver, never from self-reported volumes.
Infrastructure
Operated within isolated, access-controlled cloud infrastructure: per-study key isolation, least-privilege access, and no imaging PHI in the application tier — the pixels stay ciphertext; routing identifiers are encrypted at rest.
Data disposal
Automatic, irreversible destruction on expiry or view limit, every disposal logged.
See it move, end to end.
Walk through a release-to-destruction exchange, or talk to us about connecting your systems.
Request access