Security you can verify
medudoc processes health data under Art. 9 GDPR. That is why the platform is built from the ground up for this level of protection – encrypted throughout, with strict access protection and independently audited.
- At the centre, your patients' health data is protected.
- Encryption: AES-256 · TLS 1.2+
- Access protection: Roles · client separation
- Monitoring: Logs · alerting
- Evidence: ISO 27001 · BSI C5
Principle
Security is part of the architecture, not an add-on
Preoperative data is among the most sensitive data a hospital holds – medical history, medication, findings and consents. medudoc protects it at every level, from transmission and storage to access by individual people. The measures are contractually defined as technical and organisational measures (TOMs) under Art. 32 GDPR and are regularly audited by independent parties.
- Data processing in Germany
- AI processing exclusively in the EU
- No transfers to third countries
- One contractual partner, one data processing relationship
Evidence
Independently audited, not just promised
Certificates and audit reports demonstrate that the measures are effective. You can find the current status in the Trust Center at any time.
ISO/IEC 27001:2022
Certified since April 2026, valid until March 2029
The information security management system (ISMS) of medudoc gmbh covers the development, operation, maintenance and sale of the medudoc platform, including the processing of patient-related information.
BSI C5
BSI C5 Type 2 attested
The C5 criteria catalogue of the German Federal Office for Information Security (BSI) defines requirements for secure cloud services. A Type 2 audit confirms that the controls were effective over an audit period.
GDPR
Processing on behalf under Art. 28 GDPR
medudoc processes patient data exclusively on the instructions of your facility. The data processing agreement (DPA) and TOMs are part of the contract; an external data protection officer has been appointed.
Encryption
Encrypted in transit and at rest
At medudoc, patient data is never transmitted or stored unencrypted. Encryption is built firmly into the architecture and cannot be switched off.
Transport with TLS 1.2 or higher
Every connection to the platform runs exclusively over HTTPS with TLS 1.2 or higher and forward secrecy in accordance with BSI TR-02102-2. Unencrypted connections are technically impossible.
Storage with AES-256
Medical histories, findings, IC Sheets and consents are stored encrypted with AES-256 – without exception, including in all backups.
Centrally managed keys
Cryptographic keys are held in a dedicated key management system and rotated automatically. No one at medudoc can view or export key material; every key operation is logged.
Immutable documents
Signed IC Sheets and consents are stored with versioning and technically protected against deletion. This keeps the consent trail – the complete documentation of the patient education process – fully intact.
Access protection
Only authorised people see patient data
Your facility decides who sees which data. medudoc technically enforces the principle of least privilege – for your medical staff, for patients and for its own team.
Roles and permissions in your hands
Your administrators create user accounts themselves, assign roles and deactivate access. Each role receives only the permissions it needs for its task. Multi-factor authentication is available for all accounts.
Strict client separation
With every request, medudoc checks which facility an account belongs to. Access to data from other hospitals is technically impossible.
Patient access with no account and no password
Patients receive a personal, time-limited access code for their case. This access cannot be used to retrieve stored data; access attempts are logged and monitored for anomalies.
No access by medudoc without your consent
By default, medudoc employees have no access to your facility's data. If support needs to look into something, your administrators grant access specifically and decide themselves when it ends. Every approval and every access is logged.
Secured administration
Changes reach the platform exclusively through an automated, reviewed deployment. Direct intervention in the production environment is technically prevented, and privileged access is secured by multi-factor authentication.
Logging and monitoring
Every access remains traceable
With health data, protection alone is not enough – you also need to be able to prove it. medudoc logs security-relevant events completely and monitors the platform continuously.
Audit trail for every patient-related action
Access, changes and signatures are logged with timestamp, facility and user account. Together with the consent trail, the path of every consent can be demonstrated.
Tamper-proof logs
Logs are stored write-protected and cryptographically secured against subsequent alteration. Changes to the logging itself are also recorded.
Automated monitoring
Unusual access patterns, repeated failed sign-ins and security-critical configuration deviations automatically trigger an alert to those responsible for security.
Defined handling of security incidents
Incidents are assessed, contained and followed up according to a fixed procedure. In the event of a personal data breach, medudoc informs your facility within 24 hours at the latest.
Availability and recovery
Reliably available, even in an emergency
Patient education and consent take place immediately before the procedure. That is why medudoc is designed for high availability and fast recovery.
- service availability, contractually agreed in the highest service level
- 99.9%
- Recovery Time Objective (RTO) – maximum time until full recovery
- 4 h
- Recovery Point Objective (RPO) – maximum data loss in an emergency
- 1 h
- retention of backups, in line with medical documentation requirements
- 10 years
- Redundant operation across several geographically separate data centres in Germany
- Continuous backup with point-in-time recovery to the second and weekly full backups, encrypted
- Recovery and the emergency plan are tested in practice at least once a year
- New versions are deployed without maintenance windows and without interruption
Organisation
Security as a living process
Management system under ISO 27001
Risks are systematically assessed, treated and tracked. Management is responsible for information security and reviews the ISMS at least once a year.
Vulnerabilities with fixed deadlines
Software dependencies are automatically monitored for known vulnerabilities. Critical vulnerabilities are fixed within seven days; regular penetration tests complement the review.
Controlled changes
Every change passes through separate development, test and production environments. Production data is not used for testing or development.
Trained employees
All employees are bound to confidentiality. Before their first system access and annually thereafter, they complete training on information security and data protection.
Transparency
What you receive for your audit
As the controller, you must audit your processor under Art. 28 GDPR. medudoc provides the evidence for this – publicly, in the contract or on request.
Certificates and sub-processors
ISO certificate, information on the BSI C5 audit and the current list of sub-processors.
Handling of metadata
Which usage data is generated during operation, what medudoc uses it for and when it is deleted.
Data processing agreement and TOMs
Data processing agreement (DPA) under Art. 28 GDPR with the technical and organisational measures under Art. 32 GDPR.
Security guide for facilities
Recommendations for secure configuration, role assignment and authentication in your facility.
System description and C5 audit report
Detailed description of the security architecture and the audit results for your IT security and data protection teams.
Results of recovery tests
Measured recovery times and results of the annual emergency exercises.
Questions from your IT security or data protection team?
We answer them directly – including as part of your audit as the controller.