Security & Compliance

This page describes the security measures in place and GALIMED's certification roadmap. Certifications marked « in progress » or « planned » have not been obtained yet and must not be presented as achieved.

Security measures in place

Encryption in transit (TLS 1.2+) and at rest (Azure Cosmos DB, Azure Storage).
Secrets held in Azure Key Vault (managed identity; no secret stored in clear on the application side).
JWT authentication + 2FA (TOTP and WebAuthn/FIDO2 security keys) + Microsoft Entra ID SSO.
Role-based access control (patient, doctor, hospital, pharmacy, laboratory, admin).
Identity verification (KYC) of healthcare professionals through Stripe Identity, with institutional documents (company registration, licence to practise) for hospitals.
Security headers (Helmet, strict CSP), rate limiting, logging and request correlation (Azure Application Insights).
Authenticated billing webhooks: Stripe (signature), PayPal, Azure Marketplace (Microsoft Entra JWT verified).

Certification roadmap

Framework	Status	Approach
GDPR (EU) + DPA / BAA	In place	Record of processing activities, contractual DPA/BAA, data subject rights, data minimisation.
HDS — French health data hosting	In progress	GALIMED runs on Microsoft Azure, itself an HDS-certified host. Steps under way: migration of health data to the France Central region (within Microsoft's HDS scope), signature of the HDS contractual addendum, then a certification audit by a COFRAC-accredited body. GALIMED does not claim HDS certification until the certificate is issued; the detailed timeline is available on request.
ISO/IEC 27001	On track	Building the ISMS: risk assessment, security policies, treatment plan, internal audit ahead of a certification audit by an accredited body.
SOC 2 (Type I then II)	Planned	Definition of controls (security, availability, confidentiality), evidence collection over an observation period, audit by an independent firm.
HIPAA (USA)	On track	HIPAA-oriented controls, BAA, audit logging; dedicated US deployment profile.

Data residency

Health data for patients and hospitals in the United States stays in the United States (Azure East US 2). Everyone else's stays in the European Union (Azure France Central). This is not a stated intention: the routing is enforced in the application and verified in production every day.

See Privacy, Health Information & US Deployment for the US profile.

Penetration testing

The platform is under continuous security review. The approach:

Scope: REST APIs, authentication and authorisation, role and tenant isolation, payment webhooks, secret exposure.
Methodology: OWASP ASVS and OWASP Top 10; tests covering authentication, injection, access control (IDOR), configuration and secret management.
Internal review: code analysis and automated tests (see the internal security report).
Third-party pentest: a formal penetration test by an independent provider is planned before commercial launch; the report and remediation plan will be archived.

GALIMED is a support tool for clinical workflows and care coordination. It does not provide diagnosis, prescription or autonomous medical decisions; every AI output is reviewed by a clinician.

Security contact

Vulnerability reports or requests for compliance documentation: contact@groupe-businesstherapie.net