Security & compliance
Security and compliance before deployment.
Health data requires more than generic assurances. At VGSI, data protection, information security and regulatory assessment are entry conditions for institutional evaluation.
Our products are being prepared for controlled evaluation. VGSI does not currently claim ISO/IEC 27001 certification, CE marking, universal hospital compliance or a production clinical deployment.
Data protection by design
Before any personal-data processing begins, the project must document:
- Purpose and lawful basis
- Controller, processor and subprocessor roles
- Minimisation; pseudonymisation where reversibility is required; irreversible anonymisation only where compatible with the purpose
- Access, retention, return and deletion
- Incident and data-subject responsibilities
- Whether a Data Protection Impact Assessment is required
Where VGSI processes data on behalf of an institution, processing will be subject to the applicable Article 28 GDPR agreement.
Data boundary and deployment options
Data boundary and deployment options
VGSI's deployment strategy is hybrid. SICC is being prepared to operate as a dedicated instance for each institution or site, using hospital-controlled local infrastructure or a dedicated EU/EEA cloud environment. The applicable profile and permitted data flows are agreed before evaluation.
Location and isolation reduce exposure but do not, by themselves, demonstrate GDPR compliance. VGSI does not currently claim validated on-premises availability.
Minimisation and pseudonymisation
Identifiers separated from working data.
Where processing requires personal data, direct identifiers and re-identification information must remain separate. Any transfer to an external service requires prior pseudonymisation, a documented purpose and lawful basis, institutional instruction and the applicable contractual and technical controls.
Pseudonymised data remains personal data and continues to fall fully within the GDPR. These controls are requirements for future evaluations, not a blanket guarantee about current configurations.
Closed-site gate
Claim availability only after the controls are demonstrated.
A closed-site configuration will only be presented as available after validation for a specific institutional profile.
- Local inference inside the institution-controlled boundary
- Mandatory, fail-closed pseudonymisation before any authorised outbound traffic
- Outbound traffic denied by default, with explicitly approved exceptions
- Institution-isolated storage, keys, backups and support access
- Tests confirming that external prompts, logs and telemetry contain no clinical content
Until these gates are verified, VGSI describes closed-site as an option under preparation, not a validated deployment or a guarantee of compliance.
Security roadmap
Security roadmap
VGSI plans to develop an information security management system towards alignment with ISO/IEC 27001:2022 and consider independent certification as the organisation matures.
The roadmap covers identity and access management, encryption, logging and traceability, continuity and recovery, vulnerability and incident management and supplier controls.
MDR and EU AI Act
MDR and EU AI Act
The regulatory status of healthcare software depends on its intended purpose and context of use. SICC is designed as human-reviewed coding support. Morpheus remains investigational and is not presented as a validated diagnostic tool.
Before any release or controlled deployment, VGSI will formally assess the applicability of the MDR and EU AI Act. This statement does not constitute a regulatory determination, certification or CE marking.
Security & compliance