Security & compliance

    Patient data, protected at every step

    How we keep hospital and patient data safe: who can see what, how it's stored, where it lives and how we respond if something goes wrong.

    Compliance at a glance

    • DPDP Act 2023

      Aligned

      Personal and health data handled in line with India's Digital Personal Data Protection Act, 2023 — consent, purpose limitation and data-principal rights.

    • ABDM integration

      Roadmap

      Built to interoperate with the Ayushman Bharat Digital Mission ecosystem (ABHA IDs, health-record linking).

    • NABH Documentation

      Supported

      Workflows, audit trails and records that help hospitals meet NABH accreditation documentation requirements.

    • ISO 27001

      Roadmap

      Our information-security practices are modelled on ISO 27001 controls. Formal certification is on our roadmap.

    1.Certifications & Compliance

    How our platform lines up with Indian healthcare data regulation and recognised security frameworks.

    Enterprise Auditing Standards

    NexEagle is designed for Indian healthcare regulation first: the DPDP Act 2023, ABDM interoperability and NABH documentation needs. We sign data processing agreements with every hospital and clinic we serve, setting out exactly how patient data is handled, stored and returned. Detailed security documentation is available to customers on request.

    2.Technical Security Features

    Multi-layered technical guardrails deployed across application logic and cloud networks.

    Data Encryption & Transport

    We secure data using AES-256 encryption at rest and TLS 1.3 in transit. Backup sets are encrypted using unique keys managed by cloud Hardware Security Modules (HSMs).

    Identity & Access Isolation

    Access to production clusters requires Multi-Factor Authentication (MFA). Systems enforce Role-Based Access Control (RBAC), Single Sign-On (SSO) links, and session lease management.

    Network & Infrastructure Shielding

    Our applications run on isolated Virtual Private Clouds (VPCs) hosted in Tier-III facilities. We route traffic through Web Application Firewalls (WAFs) and DDoS mitigation clusters.

    3.Patient Data Safeguards

    Comprehensive administrative, physical, and technical measures guarding patient data registries.

    Administrative Protocol

    Includes staff security training, periodic risk assessments, a designated point of contact for data protection, and documented security incident handling procedures.

    Physical Shielding

    Covers hosting in professionally managed data centres with physical access controls, secure hardware disposal and facility access logging.

    Technical Controls

    Comprises detailed audit log archiving, system login verification, database integrity controls, and SSL/TLS transmission encryption pipelines.

    4.Incident Response Protocols

    Documented pathways to identify, isolate, resolve, and report security anomalies.

    Phase 1: Detection & Triage

    Automated monitoring watches system logs and service health continuously. Anomalies raise alerts to our engineering team for immediate triage.

    Phase 2: Isolation & Containment

    Engineers apply containment parameters, isolating affected containers or disabling compromised API tokens, preserving data integrity and preventing threat propagation.

    Phase 3: Remediation & Recovery

    Vulnerable packages are updated and services restored. If a personal data breach is confirmed, we notify affected organisations promptly and support them in meeting their reporting duties under the DPDP Act.

    5.Ongoing Security Practices

    Proactive development cycles designed to keep applications resilient against emerging threats.

    Penetration Testing & Security Audits

    We regularly test our applications and Cloud PACS APIs for vulnerabilities, and plan independent third-party penetration testing as we scale.

    OWASP Hardening & Vulnerability Management

    Our build pipelines run automated static code analysis (SAST) and software composition analysis (SCA) to flag vulnerable code dependencies before deployment.

    6.Data Residency & Retention

    Geographic database isolation and structured records maintenance compliance.

    Local Data Sovereignty

    To support regulatory requirements, all clinical and billing data is hosted on local servers inside India. Redundant clusters are placed in isolated geographic zones for disaster recovery.

    Purging & Archival Policies

    Patient records are preserved in accordance with statutory medical records retention timelines. Once contract terms expire, clinical data is securely wiped using DoD-standard purging methods.

    Found a security issue?

    Tell us privately and our team will look into it straight away.

    NexEagle, Kolkata, West Bengal, India

    info@nexeagle.com