A patient's worst day, and the drugs given to them. For any ambulance service, anywhere in the world, we treat that record like the evidence it is.
Every service's records are sealed from every other's by the database itself, not by the screen.
Who opened a patient's record, and when, is kept. Outside the treating crew, they must say why.
The record is sealed entry by entry. Change the past, and it shows.
Independent checks from outside the system, around the clock, with alarms that wake us.
On the move and at rest, on the server and on the device, including every backup.
Encrypted copies every night, held off-site and locked, so not even we can erase them.
Two-factor sign-in, and every action tied to one person. Never a shared login.
No internet, no signal, no problem. The record keeps working, and catches up when the world allows.
Every hour it checks everything that can fail quietly, from inside the system and from outside it. Anything wrong reaches us at once.
Every signature on a controlled drug, a witness, or a check is a person. No integration, script, or system can stand in for one, and no setting can change that.
Your country's health-privacy law is our floor, not our ceiling. In New Zealand we build to HISO 10029, the Health Information Privacy Code, and HISO 10052:2026. Our infrastructure holds SOC 2 Type II, and where your data lives is a conversation we have before contract, not after.
Thank you for telling us first: security@castellan.nz. A person reads every report, and answers fast.