Vendor diligence · security · chain of custody
What is actually built.
This page answers the questions a firm asks before confidential case material goes anywhere. It carries no badges and no boilerplate: every claim on it names a mechanism that exists in the product, and where something is not built or not certified, it says so.
Encrypted at rest, and locked until an operator opens it
Case data lives on our own server in Germany — not in a shared consumer cloud — on an encrypted storage volume. That volume does not merely encrypt at rest: after any restart it comes back locked, and nothing is served from it until an operator unlocks it. A powered-off or seized disk holds ciphertext and nothing else. Everything travels encrypted in transit as well.
Studies are immutable, and the original bytes are kept
Once a study is ingested it is never modified — there is no edit surface, for us or for you. Alongside the viewer’s working copy, the platform preserves the original files exactly as they were received — the disc’s contents, the records-vendor ZIP, the portal download, byte for byte. When you produce imaging, the production ships what arrived. Annotations and expert markup live in their own layer beside the matter; they never touch the pixels or the originals.
An append-only ledger, and a report you can hand the court
Every matter keeps an audit ledger built as a legal artifact, not a log file: entries are appended as events occur, drawn from a closed vocabulary of actions, and nothing in the product updates or deletes a row — including us. It records studies claimed, quarantine decisions, every link minted or revoked, every open by every link holder, expert reports submitted, and holds placed and released.
One click renders the matter’s chain-of-custody report: the studies in scope (quarantined ones shown as quarantined, never hidden), the records still outstanding, every link ever created, and the full ledger in plain English. Generating the report is itself a recorded event and appears as the report’s final line. Print to PDF is the export — the page renders the ledger verbatim, so nothing can drift from what it prints.
Share links carry a role, not just a secret
A link is minted for a job — expert, recipient or intake — and can do only that job: an expert can review, annotate and submit a written report; a recipient can only view what you scoped; an intake link can only deliver records inward. What a link may see is re-checked on every read, never stamped into the link itself — so a study you quarantine disappears from every link at that moment, including links created before the quarantine.
Each link can expire, require a passcode, forbid downloading and watermark what it shows — all enforced on the server, not by the recipient’s browser agreeing to behave. Under a protective order the envelope hardens regardless of what was asked for: watermarking is forced on and downloading forced off. Every link is revocable, and every open lands on the ledger.
The wrong patient’s records never reach your expert
Records vendors mislabel and providers misfile. When a study claimed into a matter carries a patient identity that does not match the case, it is placed in identity quarantine: excluded from the matter’s timeline, from every share link and from every export until someone at the firm reviews it and releases it. The decision — either way — is a ledger event, and the custody report discloses quarantined studies as quarantined.
Legal holds freeze deletion
When legal process arrives naming a matter — a subpoena, a preservation letter — the matter goes under a legal hold. While the hold stands, nothing in the deletion machinery can touch the matter’s data: the firm’s own delete actions refuse with an explanation, account close-out is blocked, and the automated cleanup skips it. Placing and releasing a hold are both recorded on the ledger, reason included.
A matter also tracks expected records — the study that should exist but has not arrived, with a status per record and provider refusals flagged — and the gap list prints in the custody report. And an expert’s written report freezes on submission: after that it can be read and printed, never edited. A changed opinion is a legal event, not an edit.
Patient names never ride in a URL
Pages are addressed by opaque keys. Patient names and case captions never appear in a query string, so they cannot end up in browser histories, proxy logs or analytics tooling. Search runs in your browser, over data already on the page — searching for a patient’s name never becomes a network request.
EU hosting, nightly encrypted backups
The service runs on our own hardware in Germany, operated by Oran Dynamics Ltd., a company registered in Ireland. Encrypted backups go off-site every night, each run is integrity-checked, and backups expire within 30 days — we state the window rather than rounding it to “immediately”.
What we don’t claim
No certification badges appear on this page because we hold none to show — and a badge is not a mechanism. What you have read instead is what is built, and the product’s own test suite pins these claims. The safeguards above — encryption at rest and in transit, role-scoped access, an append-only access record — are the concrete measures a firm’s confidentiality duties and, where they apply, HIPAA obligations look for; we describe them rather than badge them. If your checklist requires a business associate agreement, our BAA template is in counsel review — ask us where it stands.
Slicefield is a litigation review and collaboration platform, not a diagnostic device, and does not claim FDA clearance. Diagnosis happened at the treating provider; an expert reviewing imaging for a case is forming an opinion on the records, not rendering a primary diagnosis.
The fastest diligence is using it
Watch the demo, open a published research scan in the full viewer, or bring the first disc — the first matter is free.
Watch the 60-second demo · Open a real scan yourself · Open the first disc free