Security & deployment
Secure by design. Stated plainly.
Single-tenant: your evidence and decisions stay inside your own instance. Below are the answers quality, IT and procurement ask for, up front.
Deployment and security
One instance per client. Nothing to install.
- Delivery
- Browser-based SaaS; a single-tenant instance per client.
- Architecture
- One Cloudflare edge worker serves interface, API, documents and refresh. No servers to patch.
- Data
- A dedicated Postgres database and object store for each instance.
- Access
- Signed, HTTP-only session cookie.
- Roles
- Five roles enforced on every request; compliance reads everything and writes nothing.
- Audit
- Who queried, exported or froze what, with the data vintage. Exportable to CSV.
- Your data
- Users can export or delete their own account data.
- Devices
- Any modern browser, desktop or phone.
What Comphas is not
Clear limits, so you can trust what it is.
- Not a medical device, nor software as a medical device. No diagnostic or clinical claim.
- Not a validated GxP system. CSV, 21 CFR Part 11 and EU Annex 11 are not claimed. Validation in your estate is a scoped engagement.
- Not a registry mirror. Counts are your catalogue slice, labelled on every screen.
- Not a statistics package. No forest plot without an effect size and confidence interval.
- Not a system of record for patient data. Public registry and secondary sources only.
Secure collaboration
The sensitive discussion stays inside the environment.
Secure rooms and chats are private spaces for strategy, go/no-go calls and confidential input, kept with the evidence instead of in email threads and shared drives.
Access follows the five roles. The decision case and the audit trail record what was decided, on which data, and by whom.
Room · Programme reviewPrivate room
Illustrative conversation.
Bring your IT and quality questions.
We'll walk your teams through the architecture and the scope of any validation work.