How it is protected
Security that is built in, not bolted on
Invite-only accounts
Nobody signs themselves up. A manager invites each person, who sets their own password.
Two-step sign-in
A strong password and a code from an authenticator app, for every user.
South Africa only
Your system can only be reached from inside South Africa, behind Cloudflare’s protection and rate limits.
Roles and permissions
Crews, stores, accounts, managers and view-only — each sees only what their work needs.
Sealed records
Every submitted PRF, refusal and declaration is sealed with a SHA-256 fingerprint over the record and every signature and photo.
Append-only registers
The drug register and the occurrence book can never be edited or deleted — corrections are new entries.
A full audit log
Every sign-in, change and download is recorded with the person, the time and the address.
Your own separate system
Each service has its own address and its own database — never shared with another service.
Backed up every night
Nightly backups of the database, on top of daily backups of the whole server.
Never in search results
Your service’s system tells search engines to stay out, and only invited people can sign in.
AI on your terms
The AI that writes notes or fills the PRF stays off until you switch it on, names are taken out first, and nothing AI reads or writes goes on a record until the crew ticks it.
Safe on the phone
Unsent work is kept on the phone until it reaches your system, and signing out warns before anything unsent is lost.
Questions
Good to know
Is patient information shared between ambulance services?
No. Each service has its own separate system and database. People from one service can never see another service’s records.
Who can sign in to our system?
Only people a manager has invited. Everyone signs in with a password and an authenticator code, and access is limited to South Africa.
Can someone change a PRF after it is submitted?
No. A submitted PRF is locked and sealed with a digital fingerprint. Corrections are added as addenda or made during clinical review, and every change is in the history.
Does the AI see patient names?
Not when it writes. For the notes and the crew’s spoken account, the names and contact details the PRF knows are taken out before anything is sent. A photographed sticker or card is read as it is — its details are what is being read — while a smart ID card’s barcode is read on the phone itself. Nothing sent to the AI or written by it is logged, and the AI provider (Anthropic) does not use it to train its AI.
Questions about security?
Ask us anything at [email protected] — or book a demo and see it for yourself.