Technical and organisational measures (TOM)

You get the full TOM as an annex to the data processing agreement from datenschutz@medisync.me. A dedicated instance has its own version. The main measures of the MediSync Cloud:

Access and sign-in

• You sign in with email and password or with Google or Microsoft. MediSync stores passwords only as a hash.
• Administrative access to the infrastructure is only possible through a private management network and limited to the rights needed.
• The Connect agent in your practice authenticates with its own key. Pairing uses a time-limited code.

Encryption

• All connections are encrypted with TLS, between your device and MediSync and between MediSync's services.
• Recordings and uploaded documents are stored encrypted.
• MediSync additionally encrypts the credentials for your PVS or KIS field by field with AES-256.

Logging and traceability

• Security-relevant and data-changing operations are logged with time, person and affected object.
• Operational logs contain no patient names. References to patients appear only as a non-reversible hash.

Network

• The Connect agent only opens outgoing connections. Your practice does not need an incoming port.
• Incoming traffic passes through a protection service that blocks attacks and limits the request rate.

Organisation

• All staff are bound to confidentiality, including under Section 203 of the German Criminal Code (StGB).
• A second person approves changes to the platform before they go live.
• All results are drafts. Nothing reaches the patient record without your release.

What MediSync stores and for how long covers retention.