Where data lives, how it is encrypted, who can access what, and what we are still working on. If you are a procurement or security reviewer, this is the page to read.
Production infrastructure runs on AWS, with imaging media held in encrypted cloud object storage. If your organisation has specific data-residency requirements, talk to us before procurement and we will give you a straight answer about what we can support today.
In transit, TLS across every endpoint. At rest, AES-256 encryption for DICOM studies, scope videos, reports and supporting documents.
Access is role-based and scoped to the sale a record belongs to. A vet at one clinic cannot see a horse submitted by another unless the sale administrator or the consignor has explicitly shared it. Sales-company administrators see only horses for sales they configure.
Yes. Every submission, approval, edit, view and notification is logged with the actor, a timestamp and the resulting state. Sales-company administrators can review the audit trail for any sale they configure.
Databases are backed up daily with point-in-time recovery, and imaging media is stored redundantly. If your procurement process needs specific recovery-time commitments, ask us. We would rather agree them with you directly than publish numbers here.
Personal data, meaning vet names, consignor contacts and audit-log identifiers, is treated as Article 4(1) personal data. For access, rectification or erasure requests, contact contact@thoroughvet.com.
The honest answer is none that we will claim on this page. We would rather publish nothing than publish a badge we do not deserve. If you need a specific certification before procurement signs, talk to us about timing.
Send reproduction steps and we will get it to the right people. We do not run a paid bug-bounty programme. Email contact@thoroughvet.com.
On detection the on-call team is paged immediately and affected customers are notified. Incidents during a sale are prioritised and tracked separately, and the support team is on call through sale week.
Sales companies retain ownership of their repository data, meaning the original DICOM, the scope videos and the vet reports, and can request a complete export. There is no vendor lock-in.
We would rather answer your reviewers' questions directly than have you guess from a page. Send the questionnaire over and we will complete it.