Documentation
How Sastho Setu works
Written for the people who have to run it: an owner deciding whether to move a hospital onto it, the receptionist who will use it every morning, and the IT or compliance officer who has to approve it.
Operating guides
How care facilities operate
In preparationThe end-to-end day: a patient arrives, is seen, is admitted or goes home, and their record follows them to the next facility.
What is included free and forever, what can be bought today, and what is declared but not yet built. Counted, not estimated.
Running a hospital or clinic
In preparationFor the owner, reception, doctors, nurses, cashiers and laboratory staff — what each role can do, and what it deliberately cannot.
Being a patient
In preparationYour record, your prescriptions, your family’s access to them.
Being a doctor
In preparationRegistration, credentialing, your chambers, and working for more than one facility.
Running a pharmacy
In preparationFor the owner, the pharmacist and counter staff.
System and engineering documentation
Available to clients under agreement. Listed here so you can see what to ask for.
Architecture overview
In preparationComponents, data flows and where each surface runs.
Data dictionary
In preparationTables, relationships and what each field is for.
Platform API reference
In preparationThe permission-checked database functions every app calls, and who may call each one.
Requirements and user stories
In preparationWhat the system does, and the journeys it is built around.
Test plans and acceptance criteria
In preparationHow a release is verified before it reaches a hospital.
Security and compliance
What we do today
- Permissions are enforced in the database, not in the apps. Every privileged action is a function that checks the caller’s permission itself, so a modified client cannot grant itself anything.
- A patient’s record belongs to the patient. Another facility sees it only with recorded consent. Emergency access works without consent and writes an entry naming who looked, at what, and why.
- Identifiers are stored hashed and row-level security is enabled across the identity schema.
- Automated checks block a release if a new database function is left reachable by the public, if an app reads the medicine catalogue outside its contract, or if any key reaches a browser bundle.
What we do not have yet
Sastho Setu does not currently hold a SOC 2 Type II report, ISO/IEC 27001 certification, or a third-party penetration test report. Those are issued by independent auditors, and we would rather tell you that now than have you discover it during procurement. If your organisation requires them, talk to us about timing before you commit.
We will complete a standard security questionnaire (CAIQ or your own) honestly, including the gaps, and we can walk your technical team through the controls above.
Last reviewed 16 October 2026. Where a guide says a capability is not built, that is a statement of fact on that date, not a roadmap commitment.