# Pathways security and data handling

> Pathways stores all patient data in AWS Sydney (ap-southeast-2) and never transfers it outside Australia. Data is encrypted in transit with TLS 1.2+ and at rest with keys in AWS KMS. No personally identifying information is sent to model providers, and every analysis records the rule version that produced it.

*Source: https://getpathways.ai/security*

## Security controls

- **Data sovereignty** — all patient data is hosted in AWS Sydney (ap-southeast-2). Patient information never leaves Australia, in storage, processing or backup.
- **Encryption** — encrypted in transit (TLS 1.2+) and at rest, with keys managed in AWS KMS.
- **Patient links** — assessment links are signed with HMAC-SHA256 and time-limited. Expired links are visibly dead, never silently reusable.
- **Model isolation** — no personally identifying information is sent to model providers. Extraction and reasoning operate on de-identified clinical content.
- **Access control** — role-based. Booking staff, nurses and anaesthetists each see only what their role requires.
- **Audit and tracing** — org-wide and per-patient audit logs with full workflow tracing on every analysis, exportable for governance committees and accreditation.
- **Deterministic rules** — safety-critical screening rules are versioned and testable; every output records the rule version that produced it.
- **Privacy framework** — operated under the Australian Privacy Principles, with privacy impact documentation available for procurement review.

## Clinical positioning

Pathways is a clinical decision support tool. It assists — it never replaces — the judgement of qualified clinicians.