Cyberattack
Ransomware encrypts the servers and the network is isolated for the investigation: no access to patient records, sometimes for weeks.
CARYLIA SAFEVAULTPilot programme · Belgium & France
Medical document continuity. Even when the information system stops responding.
CARYLIA SafeVault keeps a readable copy of patient documents inside the facility: on an appliance installed on your premises, and right down to the care workstations. Cyberattack, EHR outage, network failure: care teams keep reading reports, prescriptions and results.
On premisesLocal dataOffline reading on the workstationNo outbound traffic
Product developed and proven in the lab; we are opening supported pilots in Belgium and France.
The need
When the information system stops, care does not.
As soon as the electronic health record becomes unavailable, reports, prescriptions and results can no longer be read. Clinical decisions go on — without history, rebuilt over the phone, on paper or from memory, and with no record of who looked at what.
EHR outage
An application bug, a failed update, an unavailable database: the documents exist, but nothing displays them any more.
Network failure
Telecom link, core network, a failure in a technical room: the care workstation can no longer reach the server.
Maintenance overrun
Planned work takes longer than expected, while care goes on.
764security incidents reported to France’s CERT Santé in 2025, by 606 organisations
38 %of reports forced downtime procedures or interrupted patient care — 24 % more than in 2024
75 %of these downtimes were not caused by an attack: lost telecom link, application bug — often in the EHR —, local infrastructure
NIS2hospitals may fall under the directive, in Belgium as in France, depending on their size; it requires business continuity measures
Sources: French Digital Health Agency (ANS) / CERT Santé, observatory of information-system security incident reports for the health and social-care sectors, 2025 report; Directive (EU) 2022/2555 (NIS2), Article 21.
The SafeVault answer
An independent continuity layer that complements the EHR.
SafeVault replaces neither the patient record nor archiving: it keeps a readable copy of the documents that matter for the day the main system stops responding. A limited scope, a short deployment, and coexistence designed in from the start.
An appliance installed on your premises
A Debian virtual machine, installed from an ISO image on your hypervisor (Hyper-V, VMware, Proxmox, Nutanix). Data volume encryption, encrypted backups, signed updates with automatic rollback. Data never leaves the facility.
The SafeVault Edge agent on care workstations
A Windows service keeps, on each critical workstation — emergency department, on-call physician, nursing station — an encrypted cache of its unit’s documents. With the network down or the appliance stopped, the clinician opens the workstation portal, finds the patient and reads the document.
A web console
Patient search and reading for clinicians; sources, accounts, monitoring and audit for IT. Day-to-day operation happens in the browser, with no SSH access to the appliance. The console is currently in French; English and Dutch are planned.
What makes the difference with a file copy: documents readable without a network, attached to the right patient, under traced access — and monitoring that tells the truth.
Readable even offline
Each critical workstation keeps an encrypted cache of its unit’s documents, and shows how long ago it last synchronised.
Connected to your HIS
Documents arrive through the feeds your applications already produce — HL7, FHIR, file drops — with no re-keying.
The right patient
Identity comes from the HIS message (local patient ID, national identifier when the source provides it); when a source only provides a file name, clinicians see exactly that, not a false certainty.
Controlled access
Clinicians only see documents from the care units they are entitled to, on the workstation as in the console.
A verifiable audit trail
Append-only log, HMAC-chained with a key held outside the database: any change or deletion shows, and raises an alert.
Honest monitoring
It reports nothing it has not observed: an orphaned drop folder, a workstation no longer receiving, a stopped HL7 listener are visible before the day of the outage.
Architecture
An architecture designed for downtime
Documents arrive continuously from existing applications; the appliance files them under the right patient and redistributes them to care workstations. On the day of the outage, each link works without the previous one: the workstation reads its cache even if the appliance is not responding.
Document sources
- EHR / HIS: HL7 v2 (MDM) over MLLP
- FHIR R4 connector
- SFTP drop with a dedicated account
- HTTPS drop with an API key
- Watched folders
CARYLIA SafeVault
Virtual machine on your hypervisor • local data
- Data volume encryption
- Indexing & patient search
- Accounts, roles, two-factor authentication
- Daily encrypted backups
Care workstations (Edge agent)
- Encrypted cache per unit
- Reading with the network down
- Patient search on the workstation
- Emergency, on-call, nursing
Monitoring & SIEM
- Dashboard and alerts
- Chained audit trail
- TLS syslog to your SIEM
- Appliance security posture score
AvailabilityIntegrityConfidentialityTraceability
Security
Mechanisms a CISO can verify.
The appliance measures its own posture: a dated security score computed on around fifteen criteria checked on the machine itself, capped as long as a critical criterion fails. The security dossier given to the CISO describes each mechanism — and its known limitations.
Encryption at rest
LUKS2 data volume on the appliance; AES-256-GCM cache on Edge workstations, unreadable without a successful login.
Encryption in transit
HTTPS for the console and workstations, server certificate pinned on the Edge side; HL7 MLLP over TLS, mutual TLS if needed.
Accounts and sessions
Named accounts, TOTP two-factor authentication enforceable per account, lockout after failures, short sessions closed at every restart.
Verifiable audit trail
HMAC-SHA256 chained log with a key held outside the database, append-only at database level, checked daily: tampering raises a critical alert.
Signed updates
Ed25519-signed packages, backup and automatic rollback; workstation agent Authenticode-signed and verified before installation.
Reduced attack surface
No outbound traffic to the vendor, HL7 listener closed by default, SSH can be disabled from the console, host firewall.
Compliance · Belgium & France
Designed with the sector’s requirements in mind
SafeVault contributes to your compliance effort; it does not replace it. Certifications apply to organisations — hosting providers, healthcare facilities —, not to software.
GDPRData stays in the facility, configurable retention; a GDPR fact sheet for your record of processing and your DPIA.
NIS2Contributes to business continuity, as transposed nationally (in Belgium: the law of 26 April 2024).
ISO 27001Access control, logging, encryption and backups designed to fit into your ISMS.
HDSFrance: the certification applies to hosting providers. On premises, the facility remains the host of its own data.
HAS · accreditationEvidence of continued access to records, for certification (France) or accreditation (Belgium).
SIEMSecurity logs sent as RFC 5424 syslog over TLS to your existing SIEM.
CARYLIA holds no certification to date (ISO 27001, HDS or other) and makes no such claim. The frameworks above are sets of requirements SafeVault takes into account; how they apply depends on your facility, its country and its scope.
Sectors
For facilities where access to the record cannot wait
In Belgium as in France, SafeVault is for organisations whose care goes on when the information system stops.
Hospitals & clinics
Emergency departments, wards, on-call physicians: critical workstations keep their unit’s documents.
Hospital groups & networks
Hospital networks in Belgium, GHTs in France: one deployment per facility, shared rules.
Long-term care
Nursing and care homes: residents’ essential documents remain readable during an outage.
Laboratories & technical units
Reports and results as PDF, received over HL7, FHIR or secure file drop. DICOM imaging is not covered.
Pilot programme
We are looking for our first pilot facilities.
The product is developed and proven in the lab; the next step is the test of real life. A pilot covers one unit and a few workstations, for three to six months. It is free of charge and carries no purchase commitment.
- 01
Scoping
Choice of unit, workstations and sources; IT, CISO, DPO and nursing leads; pilot agreement.
- 02
Installation
The appliance on your hypervisor: two virtual disks, data volume encryption, TLS certificate.
- 03
Configuration
Care units, named accounts with two-factor authentication, document sources, retention periods.
- 04
Edge workstations
The signed agent installed on the selected workstations, approved one by one in the console.
- 05
Outage drill
We simulate the information system going down: do clinicians find the documents they need, and how fast?
- 06
Review
Measurement against the criteria set at the start, then a decision: uninstall, or move to production.
What you need on your side
- A hypervisor: Hyper-V, VMware, Proxmox or Nutanix.
- A virtual machine with two disks (system and data).
- Windows care workstations for the Edge agent.
- At least one document source: EHR export, HL7 feed, file drop.
The company
CARYLIA, a young digital health company.
CARYLIA designs and publishes SafeVault. The company is being incorporated in Wallonia, Belgium, and targets healthcare facilities in Belgium and France.
The product grew out of an engineer’s observation: when a cyberattack or an outage hits, continuity of care still relies on paper, the phone and home-made scripts. SafeVault is designed, built and tested by its founder, an engineer, through successive releases each shipped with its own acceptance test plan.
- Stage
- Product developed (version 0.7, October 2026), proven in the lab; first pilots in preparation.
- Quality
- Every release passes an acceptance test plan of more than 400 checks before publication.
- Model
- Fixed-term on-premises licence, priced on quotation according to units, workstations and sources.
- Markets
- Belgium and France: hospitals, clinics, long-term care.
We are glad to talk with
facilities interested in a pilot, integrators and sector partners, incubators and support organisations, seed investors.
Get in touchResources
The pilot kit, for each of your stakeholders
Four working documents, sent on request with the product version they describe. They are currently written in French; tell us in the form which ones you need.
Product sheet
What SafeVault does, what it is not, and how a pilot unfolds.
Request the documentSecurity dossier
Architecture, ports and flows, encryption, authentication, audit, updates — and known limitations.
Request the documentGDPR fact sheet
Processing, retention periods, roles: material for your record of processing and your DPIA.
Request the documentPilot agreement template
Mutual commitments, duration, data, end of the pilot.
Request the documentFAQ
What IT directors, CISOs and DPOs ask us
Does our patient data pass through CARYLIA?
No. Everything is installed on your premises: no telemetry, no outbound call to the vendor. The licence is a signed file, verified offline.
How do documents get into SafeVault?
Through the feeds your applications already produce: HL7 v2 (MDM) messages over MLLP, FHIR R4 connector, SFTP drop with a dedicated account, HTTPS drop with an API key, or a watched folder. Documents are PDFs.
What if the patient’s identity is ambiguous?
Identity is taken from the HIS message: local patient ID, plus the national identifier when the source provides it — INS in France, NISS in Belgium, whose check digits are verified. When a source only provides a file name, clinicians see it displayed as such: SafeVault does not show a certainty it does not have.
What happens if the licence expires, or the vendor disappears?
The licence never stops care: thirty days of grace with no restriction, after which only adding accounts, sources or workstations is suspended. Reading, synchronisation and ingestion go on. The stack relies on standard components (Debian, PostgreSQL, Docker).
What if the appliance itself is attacked?
Encrypted volume, an audit trail that reveals any tampering, encrypted backups restorable on a fresh machine — and care workstations that keep serving their cache without the appliance.
Can it run on Windows Server?
No, and that is deliberate: the appliance is a Linux virtual machine installed from an image, for reproducible and reversible updates. A VM on your hypervisor is all it takes. Care workstations, on the other hand, run Windows.
How does it connect to our SIEM?
Security logs are sent as RFC 5424 syslog over TLS to your collector. Alerts can also be sent by email or webhook.
Is the product already deployed anywhere?
Not in production yet: we are opening the first pilots. You will not be the twentieth customer of a frozen product; you will be among the first to shape its priorities.
How is pricing built?
On quotation, after scoping: the number of units, critical workstations and sources to connect varies too much between facilities for a list price. The pilot is free of charge.
ContactReply within two working days Talk directly with the founder No patient data
Let’s talk about your document continuity
A one-hour demo by video call or on your infrastructure, scoping a pilot, the pilot kit, or a conversation about the company: tell us what would help. We answer in English or French.
An acknowledgement is sent as soon as you submit the form.
A technical conversation, with no sales intermediary.
The demo runs on fictitious data.
Get in touch
Request a demo
Describe your organisation, your role and your request; we will get back to you to arrange a first conversation.