How Aegis protects imaging — in the open.
This is the public summary of our security architecture: enough for a security or compliance reviewer to evaluate Aegis before any call or NDA. It states only properties the product actually has. The full specification — key-management internals, infrastructure topology, and exact key derivation — is available to qualified organizations under NDA.
Your imaging never reaches us in the clear.
Studies are encrypted at the endpoint (in the sender's browser) and move directly to sealed object storage. Aegis authorizes, audits, and meters each transfer, but the imaging payload passes our control plane as ciphertext only — the pixels are never decrypted on our servers. The patient identifiers needed to route a study are held encrypted at rest (per-field envelope encryption) and decrypted only transiently, in memory, to authorize and display a transfer; the billing layer never sees them at all.
In transit
TLS 1.2+ end to end; the payload is already encrypted at the endpoint before it leaves the browser.
At rest
AES-256 per-study envelope encryption; each study is sealed under its own key, destroyed on expiry.
Integrity
SHA-256 verified end to end — sent equals received, to the byte.
Access
Short-lived, least-privilege, single-purpose signed URLs; time-boxed and scoped to one recipient.
Built so a breach still isn't a disclosure.
Strong security isn't a promise that nothing ever goes wrong — it's what stays true when something does. Each guarantee below is a property of the architecture, not an operational assurance.
If our database were copied
Patient identifiers are sealed with per-field envelope encryption — the rows are ciphertext without the key, and the key never lives in the database.
If a storage object outlived its window
Its per-study key is already destroyed on expiry (crypto-shredding), so the remaining bytes are mathematically unrecoverable.
If an audit record were altered
The append-only SHA-256 chain breaks, and its Bitcoin-anchored root proves the tampering to anyone — without trusting us.
If our servers were fully compromised
The imaging never arrived in plaintext to begin with — pixels are encrypted in the sender's browser and pass us as ciphertext only.
Tamper-evident, and only a hash ever leaves.
Every authorization, access, delivery, and destruction is written to an append-only, SHA-256 hash-chained log. The chain's root hash (and only that hash) is periodically anchored to Bitcoin via OpenTimestamps, so a third party can verify the log existed and was not altered after a point in time — without trusting Aegis, and without any PHI leaving.
What we defend against.
- Aegis-insider / control-plane compromise: sees ciphertext + hashes only, never plaintext or long-lived keys
- Interception in transit: TLS 1.2+ over a payload already encrypted at the endpoint
- Stolen storage artifacts: AES-256 ciphertext under per-study keys destroyed on expiry
- Replay / over-broad access: short-lived, scoped, single-purpose signed URLs; time-boxed
- Silent tampering of records: append-only hash chain + public timestamp anchoring
- Usage mis-reporting: delivery metered independently of sender and receiver
- Data lingering after use: auto-destruct window + irreversible destruction, every disposal logged
Shared responsibility. Endpoint security of the sending and receiving organizations, their identity-provider integrity, and the recipient authorization the customer configures are the customer's responsibility. Aegis does not de-identify DICOM — de-identification, if required, must be done by the sender before upload.
Stated plainly, without overstatement.
- Operates as a HIPAA Business Associate; a BAA is executed before any PHI is processed
- Architecture and controls mapped to the HIPAA Security Rule safeguards
- Billing is designed to exclude PHI (data minimization)
- Aegis does not claim FedRAMP, DoD IL, or completed third-party certifications; any future attestation will be stated explicitly and dated
Need the full specification?
Key-management internals, infrastructure topology, and the metering/verification mechanism are available to qualified organizations under NDA.
Vulnerability reports: disclosure policy · support@aegisbiocryption.com