Security & Governance
For CISOs, privacy officers and IT architects: exactly where data goes, who can access what, and how every change is controlled.
What Exactly Leaves Your Account
Akasiio runs in your own cloud account. This is the complete list of what crosses its boundary.
| Data | Leaves your account? | Details |
|---|---|---|
| Patient data | Never | Processed only by models running in your account. Outbound traffic from clinical workloads is blocked. |
| Prompts, outputs, documents and logs | Never | Stored in your account, under your retention settings. |
| Operational health metrics | Yes, and you control it | An allowlisted set of metrics such as latency, error rates and capacity use. No content. You can inspect the flow or switch it off; incident response then becomes customer-initiated. |
| Managed AI requests (optional) | Only if enabled | Chosen topics and public documents, never patient data, sent from an isolated workload with an allowlist and outbound identifier scanning. Billed per token, with a monthly cap. |
| Support access | No standing access | We hold no credentials and no permanent access role. Changes arrive as releases your team can review. |
| Integrations | Stay inside | Connections to your EHR and imaging systems run inside your own environment. |
Controls, by Design
Deployment Architecture
Five layers inside your cloud account, in the region you choose, in Europe or North America. See the platform.
Your Account, Your Ownership
Data, models, indexes, secrets and audit trails sit under your billing and your security perimeter.
Access Control
Role-based access, and retrieval that shows users only documents they are authorised to see.
Encryption and Audit
Encryption at rest and in transit, with complete audit trails of answers, approvals and releases.
Release Control
Every model and configuration change is evaluated, staged, approved and reversible.
Portability
Runs on the major public clouds or a private cloud, on open standards.
Documentation for Your Review
Available on request, so your governance track can start alongside the pilot.
- Security OverviewArchitecture, data flows, controls and telemetry design.
- Impact Assessment SupportMaterial to help your privacy officer complete a DPIA.
- Model and Content LicencesThe licence position of every model and reference source in use.
- Evaluation RecordsBenchmark results and release decisions for the configurations you run.
Frequently Asked Questions
For CISOs, privacy officers and IT architects.
Who is the data controller?
Your organisation. Akasiio runs in your own account, and you decide how data is used, retained and deleted.
Does Xenium process our patient data?
No. Patient data is processed only inside your account, and our control plane has no access to it. We receive only operational health metrics, covered by a data processing agreement where required.
Where is our data stored?
In your own cloud account, in the region you choose in Europe or North America, or in your private cloud.
Does Akasiio support HIPAA requirements?
Akasiio is designed to support HIPAA: protected health information stays in your own account, with access control, encryption and audit trails. Your organisation remains the covered entity; we can review business associate terms with you where they apply.
Can we switch off telemetry?
Yes. The platform then keeps running, but incident response becomes customer-initiated rather than proactive.
Can we run without any managed AI?
Yes. The managed AI lane is optional. With it switched off, every model runs inside your account.
What happens if we stop using Akasiio?
Your knowledge base, adapted models, ratings and settings stay in your account in standard formats, and keep running.
How does Akasiio relate to the EU AI Act and MDR?
Akasiio is clinical decision support with human oversight, not a diagnostic device. Your organisation defines the intended use; the platform supplies oversight, records and change control. We recommend confirming your position with your own counsel.