Security Overview
This Security Overview summarises how Dealsparrow Limited, trading as NeuroClo (“NeuroClo”), designs and operates security controls for the NeuroClo healthcare technology platform. It is intended for customers, procurement teams, and security reviewers.
It should be read with our Privacy Policy, DPA, BAA, and Subprocessor List. Detailed questionnaires, penetration-test reports, and architecture diagrams may be shared under NDA upon request.
No system can guarantee absolute security. Controls described here reflect NeuroClo’s intended production posture and may be rolled out in phases as the platform matures. Feature availability varies by product version and customer configuration.
1. Security principles
- Least privilege — access limited by role, clinic tenancy, and need-to-know.
- Defence in depth — multiple layers (identity, network, application, data, monitoring).
- Privacy by design — PHI minimised in identity systems, logs, emails, and URLs.
- Boring, proven infrastructure — AWS-managed services with BAAs where PHI is processed.
- Auditability — changes to PHI tables and security-relevant events are logged.
2. Infrastructure and hosting
- Application data is hosted on Amazon Web Services in regions configured for the customer/workload.
- Primary datastore: Amazon Aurora PostgreSQL (encryption at rest; private network placement for production databases).
- Object storage: Amazon S3 with encryption (SSE-KMS), public access blocked, and access via presigned URLs only (short-lived download/upload defaults).
- Secrets and configuration are supplied via environment injection / Secrets Manager patterns — secrets are not committed to source control.
- Infrastructure is defined and reviewed as code (CDK) where applicable.
3. Identity and access management
- Amazon Cognito provides authentication (including managed passwordless / email OTP where configured).
- Cognito attributes are PHI-minimised (for example email, name, clinic association, consent date). Clinical PHI lives in Aurora keyed by user identity, not in Cognito profiles.
- Application authorisation uses role-based access (e.g. physician, technician, admin, patient) and clinic tenancy.
- Customers and users are expected to protect credentials, enable available authentication controls, and report suspected unauthorised access promptly (see Terms of Service).
4. Application and data protection
- Encryption in transit (TLS) for client and service connections.
- Encryption at rest for databases and object storage using AWS encryption / KMS.
- Row Level Security (RLS) on PHI tables in Postgres, including soft-delete (
deleted_at) constraints and clinic isolation where multi-tenancy is enforced. - Audit triggers on PHI tables; application sets user context per write transaction for accountability.
- Parameterised SQL only — no string-built queries.
- NeuroClo is designed to minimise PHI in logs, error messages, notifications, and URLs. Logging controls and PHI-redaction safeguards are continuously reviewed and improved.
- Email bodies use generic reminders (no PHI in message content); S3 access uses short-lived presigned URLs only.
- Soft delete is the default for PHI records; hard deletion follows retention / customer instructions and legal requirements.
5. Telehealth, messaging, and AI features
- Amazon Chime SDK (Meetings) for telehealth / staff meetings where enabled; recordings stored per customer configuration.
- Amazon Chime SDK Messaging for secure in-clinic chat where enabled.
- AWS-hosted AI-assisted documentation features where enabled — assistive only; clinicians remain responsible for review and approval.
- Customer data is not used to train publicly available AI models unless expressly authorised in writing. See the AI & Clinical Documentation Policy.
- Healthcare providers remain responsible for patient consent and lawful recording practices.
6. Monitoring, logging, and incident response
- Cloud and application logging for security and operational events, with controls designed to minimise PHI exposure.
- Security monitoring and alerting on the AWS environment as configured for the deployment stage.
- Documented incident response process: detect, contain, eradicate, recover, and notify.
- Personal Data Breaches / HIPAA Breaches of Unsecured PHI are notified to customers as required by the DPA and BAA.
- Suspected security issues may be reported to hello@neuroclo.com.
7. Secure development
- Changes reviewed before merge; migrations follow project conventions (timestamp-prefixed filenames).
- Automated tests including an RLS test suite for PHI tables.
- Dependency and vulnerability management as part of normal engineering practice.
- IAM policies, Cognito configuration, RLS policies, KMS, and PHI log-redaction configuration receive heightened human review.
8. Business continuity
- Managed database backups and point-in-time recovery capabilities provided by Aurora.
- S3 durability and lifecycle policies (including colder storage tiers where configured).
- Recovery objectives depend on deployment tier and customer agreement; specific RPO/RTO commitments, if any, are stated in the customer contract.
9. Compliance posture
| Area | Approach |
|---|---|
| HIPAA | Business Associate where a BAA is in effect; PHI processed on Covered Entity instructions; AWS BAAs for covered services |
| UK / EU GDPR | Processor under DPA for platform data; SCCs / UK IDTA for international transfers as required |
| U.S. state privacy | Service-provider model for customer platform data; rights handled as described in the Privacy Policy |
| Certifications | Formal SOC 2 / ISO 27001 certifications may be pursued as the business scales; current controls are described here and in customer diligence packs under NDA |
10. Customer shared responsibility
Security is shared. Customers are responsible for:
- lawful basis, notices, and consents for patient data;
- Authorised User provisioning and deprovisioning;
- endpoint security for clinic devices;
- appropriate use of roles and clinic configuration;
- exporting Customer Content before termination where needed; and
- promptly reporting suspected unauthorised access.
11. Contact
- Security / privacy: hello@neuroclo.com
- Dealsparrow Limited, 395 Clapham Road, London, SW9 9BT, United Kingdom