Security and Privacy Scope
Research beta 0.2 / 31 October 2026
Data Flow
The public website serves licensed teaching assets and application code. Selected research files are read into browser memory and parsed in a Web Worker. The application does not upload scan files, notes or feedback to a server, invoke a remote AI model or connect to PACS. Hosting providers can still process ordinary website access logs. The browser and its extensions remain part of the operator's trust boundary.
The importer does not return original filenames, patient name/ID, dates, institution names or private DICOM tags to the application metadata. This is not a complete confidentiality-profile implementation: raw files are present in worker memory during processing, and burned-in pixels are neither detected nor removed. Only already deidentified, authorized research inputs are permitted.
Retention and Export
New review notes and annotations are held in memory. A refresh or closed tab can lose them. No durable clinical record, cloud backup or authenticated identity is provided. Older prototype sessions may remain in browser localStorage until the operator explicitly deletes them through the legacy-session notice; they are not silently restored or rewritten.
Encrypted review files use AES-256-GCM, fresh random salt/IV and PBKDF2-SHA256 with 600,000 iterations. A 12-character minimum passphrase is required. Passphrases are not stored or recoverable. The file contains review state, not scan voxels; load the matching study before restoring. HTML reports, feedback CSV and activity JSON are not encrypted. Treat all exports according to the research institution's policy.
Engineering Controls
- Bounded file counts, compressed/uncompressed sizes, source dimensions and display-grid memory; a cancellable worker and processing budget.
- Strict supported-format checks; no guessed spatial orientation, compressed-image decoder fallback or missing-slice interpolation.
- Same-origin teaching-asset fetches, declared byte sizes, SHA-256 verification, timeouts and bounded retry.
- Escaped user text in reports/activity, constrained review-file restoration and CSV formula-prefix neutralization.
- Hash-linked local activity records with integrity checks on restore. Operators can alter or replace their local log; no authenticated or immutable audit guarantee is made.
- Pinned parser/rendering dependencies, lockfile and registry-advisory checks. These do not constitute a penetration test.
Not Provided
No clinical identity/role management, patient-data tenancy, server-side authorization, regulated retention system, certified deidentification, enterprise key management, disaster-recovery guarantee, independent security assessment or medical-device authorization. A passphrase-protected export does not supply these missing controls.
Operator Precautions
Use an institution-approved device/browser and research process; avoid shared browser profiles and untrusted extensions. Never place patient identifiers in notes or reviewer aliases. Investigate any geometry, integrity, source-identity or unexpected-network warning before continuing. Keep exports under your institution's access and retention policy.