Security

Last updated: 2026-09-15

The model runs on our server, not in your browser

Nothing in the Sard web application talks to a language model. Every call goes through our own server code, which means the request is logged, its cost is attributable, and the instructions the model is given are not sitting in a page anybody can open and read. The browser's job is to record the consultation and to show you the note.

The audio does not travel through us

A recording is uploaded by your browser straight into cloud storage, through a URL that is minted for that one file after we have checked that the session is yours and that consent was recorded for it. It is handed to the model by reference. It does not pass through our server code, and nothing about it is held anywhere else on the way.

The recording is also sent in pieces while you are still speaking, rather than in one upload at the end. That is a safety decision before it is a performance one: a consultation that loses its audio cannot be redone, because the patient has gone home.

The database and the audio store refuse browsers

Both are protected by rules that run on Google's side, not checks in our application — so they hold whether the request came from Sard or from someone with a copy of our public configuration.

• Audio: every read and write from a browser is denied, without exception. The only way in is the single-file URL above, and the only way out is the reference handed to the model. 7 tests hold that, and they fail when the rules are relaxed.
• Consultations: 107 tests. A clinician reaches their own sessions and no others. The time a consultation was created is stamped by the server and cannot be rewritten afterwards. The patient's identity is frozen once it is set. The transcript cannot be emptied. A signature cannot be replaced once written.

A signed note cannot be quietly changed

Once a clinician signs, the note is fixed. A correction after that is an amendment: it is added to the record rather than replacing it, and it carries who made it, when, and why. This is the same reason every generated sentence in the draft shows where it came from — the record has to be able to say that the machine proposed something and a person took it, because that is what happened.

Nothing third-party runs on a page with patient data

No analytics, no session replay, no error-reporting service, no support or chat widget, no advertising, no tag manager. Not minimised — absent. Adding any of them to a screen that shows a consultation would be a change in posture rather than a routine dependency, and it would appear on the sub-processor list before it appeared in the product.

Sign-in

Accounts are held by Google Identity Platform. Sard never receives your password in a form it could read, and never stores one. If you think a device of yours has been lost or is no longer yours, there is a control in your settings that ends every session everywhere, immediately.

Where the data physically is

Consultations are in Dammam, Saudi Arabia and audio recordings are in Doha, Qatar, because Google Cloud has no region inside Jordan and its file storage has no region in Dammam. The region where the model itself processes a consultation is not confirmed, and we will not name one we have not verified. The full table is here, service by service.

Reporting a problem

Write to [email protected], in Arabic or English. We will acknowledge within three working days, tell you what we found, and tell you when it is fixed. Our policy is published at /.well-known/security.txt in the form security tooling expects to find it.

We ask for no automated scanning that degrades the service, no access to an account that is not yours, and no disclosure until we have answered. If you believe you have reached real patient data, say so in the first line and stop.

What we have not done yet

This is the section a security reviewer reads first, so it is written for them rather than around them. None of this is a promise about a date.

• No external penetration test. The rules above are held by our own tests, which is not the same as somebody hostile having tried.
• No SOC 2, no ISO 27001, no HITRUST. We hold no security certification of any kind, and you should not infer one from this page.
• No signed data processing agreement. There is no incorporated entity to sign it yet. Until there is, a clinic cannot have from us the contract that Jordan's data protection law expects between a controller and a processor.
• No published retention period. How long a consultation is kept is a decision with legal consequences and it has not been taken. We would rather leave the row empty than fill it with a number nobody has agreed to.
• No named data protection officer. The law expects the function; we have not appointed the person.

We would rather you read this list here than assemble it yourself. If something on it is what stands between your clinic and a pilot, tell us which one — [email protected].