> ## Documentation Index
> Fetch the complete documentation index at: https://omniloy.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Security

> Security, privacy and regulatory compliance of SofIA

SofIA implements multiple layers of security to ensure protection of sensitive clinical data and compliance with international privacy regulations in the healthcare sector.

<Info>
  SofIA holds **CE Marking as a Class I medical device** and complies with **ENS High Level**, **GDPR**, and **HIPAA** standards.
</Info>

## Security Layers

<CardGroup cols={2}>
  <Card title="Transport Security" icon="lock">
    * **HTTPS (TLS 1.3)** — All REST API communications
    * **WSS** — WebSocket transcription connections
  </Card>

  <Card title="Client Isolation" icon="shield">
    * **Shadow DOM** — Complete DOM and style encapsulation
    * **Encrypted Storage** — Local session data encryption
  </Card>

  <Card title="Server Security" icon="server">
    * **API Key Authentication** — Request-level validation
    * **Audit Logging** — Complete operation traceability
  </Card>

  <Card title="Data Privacy" icon="user-shield">
    * **PII Anonymization** — Automatic masking before AI processing
    * **No Persistence** — Clinical data not stored beyond session
  </Card>
</CardGroup>

## Communications Security

### Transport encryption

The SofIA platform requires mandatory use of secure protocols for all communications:

* **HTTPS (TLS 1.3)**: All `baseUrl` properties must use the `https://` protocol
* **WebSocket Secure (WSS)**: Real-time connections via `wssUrl` require `wss://` protocol
* **Mixed content prevention**: The system automatically blocks insecure connections (`http://` or `ws://`) in production environments

### Authentication and authorization

* **API Keys**: Authentication system based on API keys with periodic rotation
* **Access control**: User and session-level permission validation
* **Access traceability**: Complete logging of all operations performed

## Clinical Data Privacy

### Data minimization

The platform implements data minimization principles to reduce exposure of sensitive information:

* **Patient data**: The `patientData` property should contain only information strictly necessary for the clinical context
* **Anonymization**: Removal of non-essential personal identifiers for processing
* **Limited retention**: Data is maintained only for the time necessary to complete operations

### Personal information protection

* **Encryption at rest**: All clinical information is stored using robust encryption algorithms
* **Data segregation**: Physical and logical separation between different clinical contexts
* **Granular access controls**: Specific permissions based on roles and responsibilities

## Regulatory Compliance

### CE Mark Class I

SofIA has CE Marking as a Class I medical device, ensuring compliance with essential safety and performance requirements established in Regulation (EU) 2017/745 on medical devices.

### ENS High Level

The platform complies with the National Security Scheme (ENS) at high level, in accordance with Royal Decree 311/2022, ensuring adequate protection of information and services of Spanish Public Administrations.

### GDPR (General Data Protection Regulation)

* **Explicit consent**: Mechanisms to obtain and manage patient consent
* **Right to be forgotten**: Capability for complete data deletion upon request from the data subject
* **Data portability**: Data export in standard and interoperable formats
* **Data residency**: Options to maintain data within the European Union

### HIPAA (Health Insurance Portability and Accountability Act)

* **BAA (Business Associate Agreement)**: Agreements available for covered entities in the United States
* **Administrative controls**: Policies and procedures for PHI management
* **Technical safeguards**: Security measures for data access and transmission

## Audit and Monitoring

### Complete traceability

The system comprehensively logs all operations to facilitate audits and compliance:

* **Session identifiers**: Recording of `userId` and `patientId` for each operation
* **Timestamps**: Precise timestamp of all transactions
* **Schema versioning**: Version control of `template` used in each report
* **Report persistence**: Complete traceability from generation to storage

### Quality monitoring

* **Schema validation**: Automatic verification of `template` through linting in the deployment process
* **Performance metrics**: Continuous monitoring of WebSocket latencies and error rates
* **Accuracy auditing**: Optional accuracy evaluation and hallucination detection processes available upon request

### Quality controls

* **Medical review**: Integration with validation workflows by healthcare professionals
* **Automatic alerts**: Notifications upon anomalies or irregular behavior patterns
* **Compliance reports**: Automated generation of reports for regulatory audits

## Next Steps

1. [System architecture overview](/sofia/en/platform/architecture)
2. [Configure required properties](/sofia/en/sdk/required-properties)
3. [Patient data and anonymization](/sofia/en/sdk/patient-data)