Audit, security & system operations

Quickly reconstruct a transaction and its AI and human decisions, and detect missing or manipulated evidence.

A versioned event catalogue records user, system, infrastructure and AI paths, including reading, rejection, export, emergency access, migration, support, policy, key and configuration changes; module registration demonstrates mandatory paths.

Evidence search connects process, command, revision, causality and correlation IDs and time sources. UUIDv7 alone is not a binding order; the sequence and commit context come from the designated journal.

A protected reconstructive view shows the action, purpose, decision foundations, authorisation, human approval and professional result; sensitive original data and AI contexts are decrypted only with additional authorisation.

Verification processes compare the operational journal, outbox and archive receipts, and independent integrity evidence; gaps, delayed archiving and manipulation produce a monitored finding. A hash alone proves neither the accuracy of a statement nor the completeness of all real events.

A disabled domain module cannot switch off audit or tenant protection. A lack of persistent auditing for online read approvals must not silently release plaintext data; outage behaviour follows the approved foundation concept.

The audit itself is sensitive: purpose limitation, separate access rights and versioned retention and deletion rules apply; search and export access is also evidenced without endlessly recursive content logging.

Responsibility

Data protection staff and auditors act according to each approved purpose, security operations access technical metadata and archive administration is independent; an organisation administrator does not receive comprehensive audit full-text access.

Automation & AI

Rule-based completeness and integrity checks and escalation. AI can summarise authorised evidence with sources for each item; it does not prove truth, delete findings or present chain-of-thought as evidence. AI features require activation at your request. Processing remains on Oronela's own servers in Switzerland.

Identify problems early and enable evidenced recovery of all protected data and services.

The operational overview shows required services, databases and replication, audit and archive, keys, identity, jobs, GPU, backups and permitted external connections with a reliable source and version; no PHI appears in ordinary telemetry labels or stack traces.

Alert profiles have priority, responsible people, substitutes, escalation and acknowledgement; accepting an alert is separate from actually resolving it. Missing monitoring is itself a visible state.

Key rotation is prepared, approved, executed and verified; current and old data segments, backups, audit records and recovery requirements remain decryptable under retention rules. There is no plaintext fallback during a KMS outage.

Backup and restore runs include data, documents, audit, identities, configuration, required keys and deletion or revocation lists. Recovery takes place in isolation first; deleted content must not be served normally again after restoration.

RPO, RTO and availability targets from the architecture are demonstrated through measurable exercises; “backup successful” is not proof of restoration. Actual incident and restore approval requires named responsible people.

Runbooks contain safe diagnostics, limited actions, fallback, professional emergency operation and communication routes. Security controls must not be silently disabled to optimise speed.

Responsibility

Technical operations works within narrowly defined actions; key and recovery leads have defined separation of duties; professional leads confirm domain service resumption. Audit and archive administration remains independent.

Automation & AI

Health checks, backup checks, rotation steps and exercises are orchestrated deterministically. AI may explain sanitised technical data and suggest runbook steps; no autonomous decryption, deletion or production recovery cutover. AI features require activation at your request. Processing remains on Oronela's own servers in Switzerland.

Reliably operate a private GPU and server installation and allow time-limited support without standing access to care records.

Supported private and SaaS profiles use the same mandatory protection. Configuration must not disable tenant checks, auditing, encryption, AI gateway protection checks or revision control.

Private release includes the required locally available artefacts, containers, models, translation catalogues and operational documents with traceable provenance and licences. Within the approved local functional scope, there is no runtime dependency on public AI, telemetry or licence servers.

Necessary external domain interfaces remain explicitly configured and show when they are unreachable. Egress is controlled; failing external services do not trigger hidden alternative providers.

A support request contains the reason, identity, tenant, narrowly scoped actions and data, duration, approvers and purpose. Required access is activated for a limited time, recorded and automatically revoked; there is no standing full access or shared support account.

Support packages are minimised or redacted and reviewed before sharing; secrets, keys and free-form health data are not collected automatically. Diagnostics with content access are separately approved and traceable.

The installation or upgrade profile is verified against its security configuration and artefact hashes; failed checks prevent release. Rollback must not violate schema, audit or key compatibility.

Responsibility

The local operator runs the system, responsible organisation and data leads approve specific support, the support person receives only a temporary role, and an independent reviewer checks evidence. The approving person cannot arbitrarily delegate beyond their own authority.

Automation & AI

Automatic profile validation, expiry and revocation, and sanitised diagnostic packages. Local AI may provide operational help using approved knowledge; it can neither approve support access nor change firewall or audit rules based on a document. AI features require activation at your request. Processing remains on Oronela's own servers in Switzerland.

Personal data requests are followed from identity checks and source search through to evidenced execution.

Residents, staff and authorised representatives receive an accessible route to request access, correction, restriction or deletion. The responsible party checks identity, representation, a secure reply channel, scope and deadlines against the approved customer and legal profile. There is no unverified universal retention period.

Data search queries registered domain modules in a controlled way. Every result identifies person assignment, source, purpose, period, revision, derived copies and retention or hold status. A module error is shown as incomplete coverage, not an empty result.

Before disclosure, information about third parties and protected staff and clinical content are reviewed. A representative does not have a blanket entitlement to every internal investigation. Restrictions and redactions require a responsible decision with a traceable explanation.

A disclosure package connects readable documents, structured data where applicable and a source directory. Recipient, purpose and exact content revision are approved before protected handover. Access, expiry and current permission are also checked on retrieval.

Corrections go to the authoritative domain process. Signed care entries, prescriptions, time records and messages are not overwritten through general deletion or writing access. The objection, decision, original and permitted addendum remain traceable together.

Retention rules specify data category, legal profile, triggering event, duration rule, responsible parties and exceptions. A reasoned retention hold is approved separately and reviewed regularly. Before deletion, a preview shows the affected sources and impacts.

Search and vector indexes, AI context and memories, reports, exports, temporary files, permitted mobile copies, object versions and backups are included in the scope. A UUID or hash does not prove anonymisation. Copies lawfully retained require their own purpose and restricted access.

New restrictions or changed sources make affected execution plans subject to renewed review. Each professional module carries out its own permitted action and provides evidence. A case closes only after complete reconciliation of all required results or justified exceptions.

Protected audit evidence and lawful retention holds are preserved. Immutable archives follow their approved lifecycle. When older backups are restored, current deletion, restriction and revocation decisions are applied before access resumes.

Responsibility

Specially authorised data protection leads handle content and legal approval. Technical administration sees necessary operational metadata and receives no general access to complete records.

Automation & AI

Collection, reminders and approved resumption are automated under control. AI can draft an authorised explanation, but does not decide entitlement, disclosure, retention holds or deletion. AI features require activation at your request. Processing remains on Oronela's own servers in Switzerland.

Connection & offline use

Source search, disclosure approval, export, restrictions, deletion and closing require an online connection.