The CFO
One flat licence per building. No per-user, per-token or per-note fees, ever. Hardware is capital your foundation can fund; the licence is predictable operating spend. No meter means no rationing, and no shadow AI.
Sovereign by design · enterprise by default
The hospital's control layer for AI.
Every model, agent and forecast your hospital runs, yours, ours, or any vendor's, works on your own infrastructure under one set of rules: role-based access, human approval where it matters, and an audit trail that holds up to scrutiny. Patient data never leaves the building.
The AI assists; clinicians decide.
Single tenant, inside your boundaryZero data egressEvery interaction auditedFlat licence · no per-user fees
Launches from inside the chart (SMART on FHIR) · Demonstrated against the public sandbox
Demonstration environment. Every account, document, conversation and forecast inside is synthetic. Nothing here touches real patient data.
01 · Without governance
Every vendor ships a model. Nobody ships the governance.
A hospital can buy a model from any vendor and have it answering questions inside a week. What it cannot buy is the answer to who asked, what was retrieved, which policy applied, and who approved the result. The model arrives. The rules around it do not.
Four questions most hospitals cannot answer today:
- /Which model answered this question, and what did it read to get there?
- /Who is allowed to ask it, and who is allowed to act on its answer?
- /Where did the patient data go, and who can prove it stayed inside?
- /When the answer was wrong, who was watching, and what did they do?
What that costs:
- /Decisions you cannot defend, because no one recorded who decided or on what.
- /Data that leaves the building through a path no one mapped.
- /Models that change overnight, with no notice to the clinicians who rely on them.
- /Approvals that happen, or do not, with no record either way.
- /Trust that erodes every time an answer cannot be explained.
None of this is an argument against AI in hospitals. It is an argument against ungoverned AI in hospitals.
02 · With SALVEA
One runtime. Every vendor. Your rules.
SALVEA sits between every model the hospital runs and the people who rely on it. Yours, ours, any vendor's: every call runs under an audit trail that holds up to scrutiny. Patient data never leaves the building. The AI assists; clinicians decide.
- Every answer carries its model, its sources, and the policy that let it through.
- Access is role-based, so the right people ask and the right people act.
- Egress is a policy you switch on, not a default you discover.
- Model changes are versioned and announced before they reach a clinician.
- Sensitive actions open an approval request, and every approval is recorded.
- Every decision is signed by the clinician who made it, with the reasoning attached.
- Every answer can be explained, so trust is earned, not eroded.
The vendors do not govern your hospital. You govern the vendors.
03 · For the people who sign
Money. Risk. Effort.
Counsel and the CISO
Every answer is an audit event: who asked, which model, what it read, who approved. Egress off by default, blocked attempts recorded. The assessment pack answers your privacy review in one document.
Your IT team
Single tenant inside your network. Any model over standard endpoints; launches from the chart (SMART on FHIR). Day 30: your team runs it unaided.
04 · Core pillars
Governance by design
Zero egress
Models, retrieval and audit stay inside the institution's boundary. Egress is a policy you switch on, not a default you discover.
EGRESS_PROTOCOL: OFF_BY_DEFAULT
Human in the loop
Sensitive actions open an approval request with the exact content and the triggering policy. Nothing is filed on its own.
REVIEW_PROTOCOL: HITL-2.4
End-to-end audit
Every message, retrieval, action and approval writes an audit event: who asked, which model, what was retrieved, how the answer was formed.
AUDIT_STREAM: IMMUTABLE
Your infrastructure
Bedside edge, unit node, hospital server room or provincial data centre: each model carries its deployment location and guardrail tier.
DEPLOY_TIER: CRATON_FLEET
05 · Three layers, one institution
A unified clinical stack
Hardware, runtime and clinical products, each owned by the institution, each auditable end to end.
Model Store
Clinical products the institution chooses to run, each with its own evidence, evaluation history and guardrail tier.
SALVEA
The governed runtime: who may ask what, which model answers, what needs a clinician's decision, and the record of all of it.
CRATON
Compute that lives in the hospital: bedside devices, unit nodes and the server room, monitored as one fleet.
MODEL STORE
SALVEA
CRATON
06 · The scoreboard ships with the platform
Instrumented from day one
Every SALVEA deployment measures itself. These meters are built into the platform, baselined in week one, and reported with method, co-authored with the institution.
MET-DOC-01
Documentation minutes returned per clinician per shift
STATUS: BASELINED_WEEK_ONE
MET-DS-09
Discharge summary turnaround
STATUS: TIMESTAMPED_NATIVELY
MET-GRD-04
Grounded-answer rate; unsourced lines filed, target zero
STATUS: LIVE_FROM_DAY_ONE
MET-VOICE-07
Clinician acceptance, in the unit's own words
STATUS: RECORDED_WITH_CONSENT
MET-OPS-02
Uptime, latency and the zero-egress counter
STATUS: ALWAYS_ON
The first pilot's numbers will appear here with their method and the institution's co-signature. Nothing less makes it onto this page.
What clinical teams get
Why clinicians will actually use it.
- Grounded answers that cite the hospital's own approved documents
- Notes and discharge summaries drafted, then signed by the attending clinician
- Second opinions requested from named colleagues, with every stance recorded
- One operational picture of departments, wards, staffing and devices
Privacy officer or CISO? Start with the assessment pack: the ontology, actions, purposes, audit model and placement policy, in one document.
Request the assessment pack