Trust & Security
Security and
trust
Patient data is the most valuable thing a healthcare facility holds. MorLuang is built with defence in depth — several layers working together so the data stays protected, auditable and available.
Defense in Depth
Layered protection
No single mechanism carries the weight. Each layer does its own job, and if one is bypassed the next still holds.
Authentication
- Single sign-on through Keycloak (OAuth 2.0 / OIDC)
- JWT-based sessions — no password is ever stored in a cookie
- Multi-factor authentication, enabled to your organisation’s policy
- Session timeout and automatic logout on a configurable period
Authorisation
- Configurable role-based access control
- Feature-level permission codes — over 178 control points
- Every API endpoint bound to a permission at the routing layer
- Tiered rate limiting to prevent abuse
Multi-tenant isolation
- Tenant scoping at the ORM level — every query is bound to a company automatically
- Strict mode on health and financial models — data without a tenant is rejected outright
- Cross-tenant penetration testing, 54 of 54 passing in both directions, before every deploy
- Even a badly written query cannot return another organisation’s data
Encryption and transport
- TLS 1.3 on every endpoint, HTTPS only
- Encryption at rest for both the database and object storage
- Managed secrets — no credentials in source code
- Internal service-to-service traffic stays on a private network
Auditing
- Every access to patient data logged with timestamp, user and IP address
- Request ID tracing — one identifier follows a request through every log
- Coverage policy snapshots — the rule version used is stored with each visit
- Four levels of health check — liveness, readiness, database and integrations
Backup and recovery
- Automatic daily backups, retained on a tiered schedule
- Storage-efficient dump and hardlink strategy
- Scheduled disaster-recovery drills with documented procedure
- Retention of 7 days, 4 weeks and 12 months
Service Level
Service levels by plan
Pick the level of guarantee that matches the size and criticality of your facility.
| Plan | Uptime SLA | MTTR | Backup |
|---|---|---|---|
| Clinic | 99.0% | < 4 hrs | Daily |
| Hospital S | 99.0% | < 4 hrs | Daily |
| Hospital M | 99.5% | < 2 hrs | Daily + weekly |
| Hospital L | 99.9% | < 1 hr | Daily + weekly + monthly |
| Enterprise | 99.99% | By agreement | Custom + off-site |
MTTR = mean time to recovery.
Compliance
Standards we follow
PDPA
Thailand’s Personal Data Protection Act — right of access, right to erasure and data portability all supported
Thai health authority standards
Data formats and reimbursement submissions follow the national standard file structures
OAuth 2.0 / OIDC
Standards-based authentication through Keycloak
TLS 1.3
Modern transport encryption throughout
Your Data, Your Control
Your data belongs to you
Patient and facility data belongs to the customer, not to us. You can export all of it at any time — while you are using the service and when you stop.
Export at any time
CSV and FHIR-compatible output, with the data structure documented
No vendor lock-in
Open standards throughout, so you can move to another system if you choose
Right to be forgotten
Data deleted under the PDPA when the contract ends
Incident Response
When something goes wrong
Detection
Four levels of health check, monitoring and alerting reach the technical team within the first minute
Triage
Severity graded P0 to P3 by the impact on the system and on users
Mitigation
P0 responded to within 2 hours, P1 the same day, P2 within 3 days
Communication
Customers receive status updates at set intervals, and a post-mortem report follows any P0 or P1 incident
Questions about security?
We are happy to answer them and to send our security whitepaper to your IT or procurement team.