Security

1. Security Overview

NexaRad is built with healthcare-grade security architecture from the start. The platform runs on AWS with private networking, encryption at rest and in transit, role-based access controls, and comprehensive audit logging. This page describes the security posture of the NexaRad demo and research platform.

2. Authentication and Access Control

• HTTP-only, SameSite session cookies with CSRF protection for all unsafe methods.
• Role-based access control (RBAC) across system admin, org admin, radiologist, operator, and viewer roles.
• Organization-scoped tenant isolation enforced at the repository layer.
• Production SSO/OIDC integration ready with MFA support for admin and clinical roles.
• Session expiration and secure cookie flags enabled in production configuration.

3. Data Protection

• TLS 1.2+ encryption for all data in transit.
• AWS KMS encryption for data at rest (S3, RDS, EBS, Secrets Manager).
• Application-level encryption of direct identifiers where applicable.
• PHI uploads blocked by default in demo and research modes.
• No PHI in application logs, error messages, or client-side storage.

4. Network Security

• Private VPC with public subnets for ALB only.
• Application and database services in private subnets.
• AWS WAF protection for web endpoints.
• Security groups with least-privilege access rules.
• VPC endpoints for AWS services where available.

5. Audit and Monitoring

• Comprehensive audit logging for all study, finding, report, and user actions.
• Immutable audit events with actor, resource, timestamp, and metadata.
• AWS CloudTrail enabled for API activity monitoring.
• AWS GuardDuty and Security Hub enabled for threat detection.
• CloudWatch for application and infrastructure monitoring.

6. AI Security

• External AI providers disabled by default and gated behind explicit policy configuration.
• Model registry with versioning, regulatory status, and enable/disable controls.
• Verifier guardrails block unsupported diagnostic claims before report finalization.
• No PHI sent to external AI providers without explicit BAA, region, and policy approval.

7. Vulnerability Reporting

We welcome security research and responsible disclosure. Please report security issues to [email protected]. We aim to acknowledge reports within 48 hours and provide a timeline for resolution.

8. Compliance Status

The current NexaRad demo/research platform is not HIPAA-compliant, FDA-cleared, or SOC 2 certified. Clinical deployment requires completion of the full security, compliance, and regulatory program. Enterprise customers should contact NexaRad to discuss deployment requirements.