🔒
Immutable original
The moment a clinician acts, the original is locked
First edit, paste, or save triggers an automatic preservation event. The original transcript text is written to a dedicated database with a SHA-256 hash. No user can overwrite or erase it. The corrected copy lives separately — what was said is never confused with what was edited.
📋
Append-only audit
Every consequential action leaves a permanent mark
Edit. Paste. Save. Delete. Correct. Each action appends an audit event with timestamp, Windows username, and machine name. Two database triggers enforce immutability at the engine level — even a database administrator cannot silently erase the trail.
🎙️
Audio evidence chain
Microphone recordings enter the evidence chain before transcription
Audio is written to disk first. A SHA-256 fingerprint is computed before the engine sees the file. The clinician then decides whether to retain the audio. That decision and who made it are in the audit trail. The chain runs: audio file → fingerprint → transcript → corrections → audit.
🗑️
Logical delete only
Deletion hides a record — it does not destroy it
When a clinician deletes a session, the record is flagged as deleted with the clinician's identity and timestamp. The clinical data and audit history are retained for investigation and compliance review. Physical erasure requires a separate authorised administrative action.
🪪
Tier 1 — Standard
Windows identity and AHPRA registration at install
The operator's name is drawn from Active Directory. Their AHPRA Certificate of Registration is uploaded, parsed, and matched against declared details. Registration number, profession, expiry, and status are all verified against the official certificate at installation — with the result stored as a tamper-evident record.
🎤
Tier 2 — Professional
Voice-confirmed operator identity before every session
A short speaker verification step before recording begins confirms the enrolled clinician's voice. Three-attempt flow with graceful Tier 1 fallback. OPERATOR_VOICE_VERIFIED is written to the audit trail with confidence score. Enrollment is admin-only — self-enrollment is not permitted.
🧬
Tier 3 — Enterprise
VincuSeal biometric token — phononic fingerprint and EEG
At Enterprise tier, the VincuSeal platform provides a signed token confirming phononic fingerprint and cognitive state verification. PhononicGuard receives the token, validates the signature, and records OPERATOR_VINCU_VERIFIED with verification level in the audit trail. The clinical record cannot be opened without it.
🚫
Session gate
No session opens until identity is confirmed
Start Long Job and Start Recording are disabled until the operator gate is satisfied for the installed tier. Tier 2 and 3 controls are visible in Standard edition with an upgrade prompt — not hidden — so clinicians know what their organisation could have and can request it.
🖥️
Offline-first
Sensitive speech processed locally by default
The speech engine runs locally on the clinician's machine. Audio and transcripts do not leave the device unless the organisation explicitly configures a remote engine. Patient conversations are not routed through third-party cloud services as part of standard operation.
🔑
Registration number privacy
The AHPRA number is never stored in plaintext
At onboarding, the full registration number is hashed using SHA-256 immediately after entry. Only the hash and the last four characters are retained. The plaintext is discarded and never written to any database. Subsequent sessions use the last-four challenge, not the full number.
📁
Certificate privacy
The registration certificate is processed, not permanently stored
The clinician's Certificate of Registration is uploaded for one-time verification. After field extraction and matching, the PDF is deleted. The SHA-256 fingerprint of the document and the extracted verification result are retained — not the document itself. The clinician owns their certificate; the system holds only the proof of what it contained.
🏥
Air-gapped deployment
Works in hospital environments with no external network access
Upgrade prompts, help content, and operator onboarding flows are all served from local XAML — no network calls during clinical operation. The system is designed for environments where IT policy prohibits outbound connections from clinical workstations.
🌏
9 registration bodies
Australia, UK, India, China, France, Spain, NZ, Singapore — from day one
Registration authorities are held in a configuration table, not hardcoded. Each entry carries the country, public register URL, registration number label, and certificate upload support flag. Adding a new country requires inserting one database row — no code change, no rebuild, no redeployment.
🗣️
5 clinical languages
English, Mandarin, Hindi, Spanish, French — all on the local engine
The speech engine processes clinical audio in five languages with Australian-convention normalisation for English. Medical terminology, medication names, and procedural language are normalised to the target locale — paracetamol not acetaminophen, FBC not CBC, GORD not GERD.
🇦🇺
Australian primary market
Built around AHPRA, Australian medical conventions, and local compliance requirements
The default installation targets Australian hospitals, specialist centres, and GP practices. AHPRA is the primary registration authority. Australian English medical terminology is the default normalisation baseline. Southeast Asian deployment — Malaysia, Vietnam, Thailand — is under active scoping.
📜
Certificate translation
Non-English certificates supported with NAATI translation guidance
Certificates from Chinese, French, and Spanish registration bodies may require NAATI-accredited translation before upload. The system displays the requirement at onboarding for the relevant bodies and accepts the translated document for extraction and matching. The original and translation are both hashed for evidence.
