IronDICOM - Security

Patient data stays in your hospital

No telemetry. Neither product reports usage to the vendor.
No vendor remote-access channel.
No dependence on a cloud service. Both products run on fully air-gapped networks.
Alerts, e-mails, reports and support bundles contain no patient data, and automated tests keep it that way.
Audit events sent to your SIEM say what happened and who did it, not who the patient was.
The optional cloud status feed sends counts only, outbound only, and is off by default.

Encryption at rest and in transit

KomvOS encrypts every stored object with AES-GCM, using versioned keys.
Trident encrypts local storage with AES-256-GCM, with the key tied to the machine.
TLS 1.2 or later for DICOM and HL7 connections, with a TLS 1.3-only setting in KomvOS. Older protocol versions are never chosen silently.
Certificate pinning per peer in Trident.
HTTPS for web administration.
Secrets inside configuration backups are encrypted.

Identity and access

Three roles in each product, administrator, operator and auditor, enforced on the server for every request.
Sign-in with Active Directory or LDAP accounts.
OpenID Connect single sign-on in KomvOS, and authenticator-app codes (TOTP) for local accounts.
Strong password rules, lockout after repeated failures and throttling of network sign-in attempts.
Idle sign-out, and a random one-time password at first start.
Emergency administrator reset is possible only at the server itself.
Trident accepts studies only from the AE titles you list.

An audit trail you can verify

Sign-ins, configuration changes, views of patient studies, deliveries and failures are all recorded.
Each event is linked to the one before it with a SHA-256 hash, so a removed or altered event breaks the chain.
Verify the chain on demand. Older events are sealed into archives.
No record, no action: if viewing a study cannot be recorded, the page is not shown.
Export to your SIEM by syslog (RFC 5424) over UDP, TCP or TLS.

The stored original is never modified

Transformations, de-identification and corrections are applied to a copy at the moment of sending. If a transformation fails, nothing is sent and the original is untouched.

De-identification and pixel redaction fail closed: an object that cannot be processed stays where it is.

Hardened against hostile input

DICOM parsing is guarded against deeply nested and oversized data built to crash a parser.
Listeners limit message size, time and connections, and drop connections that go silent.
In KomvOS, image codecs run in an isolated process.
In Trident, every disc and upload is treated as untrusted input.
Error messages are plain sentences. No stack traces reach the screen.
Digitally signed installers.
Trident can run as a least-privilege virtual account or group managed service account.

AI that cannot see patients

The optional KomvOS AI Assistant is off by default, uses only a model running inside your own network, and never receives patient data.

Any feature that would read patient data is locked at the server by a setting that no screen, API call, restore or fleet push can change. Even when a hospital chooses to open it, the data goes only to a model on the same machine.

Supporting your compliance work

IronDICOM gives you the technical controls that HIPAA, GDPR and similar rules expect of a system that handles imaging: access control, encryption, audit, integrity protection and de-identification based on DICOM PS3.15.

Each product comes with a DICOM Conformance Statement and a security disclosure structured on the MDS2 form, so your reviewers can check every statement on this page against the detail.

We describe what the products do and leave certification claims out. Compliance is something your organisation achieves; our job is to make it easier.

See IronDICOM on your own network

Ask for a guided demonstration built around your modalities, your PACS and your routing rules.

Request a demo

Page updated

Google Sites

Report abuse