Procurement-ready trust center
Use the published topics to identify evidence needed for vendor review and due-diligence questions. Scope and operating responsibility are confirmed during the evaluation.
Security, governance, and responsible operations.
Review published security and governance topics for Healthcare Execution Infrastructure. The topics frame deployment-specific questions; their count is not an independent certification or proof of control coverage.
Report a security concernContent review reference
2026-09-09
Listings are published control topics or evaluation topics. Confirm operating scope and evidence; the reference date is not a security attestation.
35
Published topics
0
Evaluation topics
Overview
Elizian is Healthcare Execution Infrastructure. These published control topics support procurement and security review; applicability and evidence must be confirmed for the proposed deployment. A topic listing is not a certification or a claim that every control is enabled everywhere.
Layered security model
Review transmission, storage, hosting boundaries, and access restrictions for the services and information in scope; the public website does not establish deployment-wide coverage.
Operational accountability
Action ownership, approvals, configuration controls, and auditability govern how the platform is operated.
Security
Security topics to review against the agreed service, hosting arrangement, data flows, and responsibility boundaries.
Encryption in transit and at rest
Confirm transmission protocols and storage protections for the actual services and data stores involved; applicable safeguards depend on the implementation.
Network segmentation
Review the applicable hosting architecture and network boundaries with the technical and security teams; no universal segmentation claim is made here.
Least-privilege access
Access should be limited to approved duties and reviewed against configured roles, administrative responsibilities, and data-access rules.
Privacy
How operational information is handled, retained, and scoped to the appropriate boundaries.
Configurable retention
Retention requirements follow applicable policy, agreements, and customer instructions. Confirm supported configuration and deletion behavior for the relevant data.
Structured data exchange
Information exchange is scoped to agreed interfaces, permitted purposes, and approved system access; availability requires technical confirmation.
Regional and organizational scoping
Regional and organizational data requirements are evaluated for each engagement; displayed countries do not establish local regulatory readiness.
Data Governance
Tenant separation, scoping, and governed configuration of operational data.
Tenant separation
Review customer-data boundaries, administrative access, and separation controls for the actual environment. This public website does not establish or guarantee tenant isolation.
Country and regional scoping
Terminology and operating rules are reviewed against the engagement's jurisdiction and approved scope; configuration alone is not evidence of regulatory compliance.
Configurable governance and approvals
Approval workflows and configuration controls provide operational accountability.
Identity & Access
Authentication and authorization controls governing who can reach and act on operational data.
Single sign-on
SSO depends on the organization's configured identity provider and enabled sign-in path. Confirm the supported arrangement; coverage is not claimed across every workspace.
Multi-factor authentication
MFA availability and enforcement depend on the configured sign-in paths and account requirements. Confirm coverage for the proposed environment.
Role-based access control
Review the configured roles and data-access rules for the responsible teams; team, tenant, and country scope must be confirmed for the implementation.
Permissions scoping
Authorized access should follow approved responsibilities. The effective boundaries depend on the configured permissions and must be validated for the environment.
Auditability
Time-stamped, attributable records of actions, approvals, and configuration changes.
Time-stamped activity logs
Confirm which actions, approvals, escalations, and configuration events are recorded, along with retention, review, and access requirements.
Attributable accountability
Review how recorded events identify the responsible user or role; event coverage and available evidence depend on the configured workflow.
Business Continuity
Resilience, recovery, and incident response for mission-critical operations.
Resilient infrastructure
Service availability depends on the hosting services, deployment, and external dependencies. Any availability commitment must be established in the applicable agreement.
Recovery procedures
Review applicable backup, restoration, and recovery responsibilities; recovery objectives and supporting documentation require confirmation for the engagement.
Incident response
Use the security-reporting route for suspected issues. Response, cooperation, and notification obligations follow the applicable facts, agreements, and legal requirements; no response time is promised here.
Integration Security
How required enterprise systems connect through agreed interfaces and scoped information flows. Specific systems and data scope are defined during discovery and confirmed with the client's technical and security teams.
Structured system integration
Healthcare-system interfaces require agreed scope, supported exchange methods, and approved access; this topic is not a list of live production integrations.
Scoped information flows
Information flows are scoped and confirmed with the client's technical and security teams.
AI Governance
Responsible, human-in-control AI assistance with clear boundaries on decision authority.
Human-in-control AI assistance
AI assists operational teams; it does not replace licensed or accountable decision-makers.
Responsible AI boundaries
Clinical judgment, authorization decisions, and regulated responsibilities remain with the appropriate licensed or accountable organization.
Elizian executes workflows. Healthcare organizations retain clinical authority.
Hospitals, physicians, health plans and appropriately licensed organizations retain clinical decisions, discharge approval, medical-necessity determinations, authorization decisions and patient-care responsibility. Elizian provides operational workflow, coordination, execution visibility, escalation and completion tracking around those decisions; not licensed clinical judgment. Elizian does not diagnose, determine treatment, or determine medical necessity.
No clinical decision-making
Elizian does not diagnose, determine treatment, or determine medical necessity.
Licensed-professional responsibility
Regulated responsibilities remain with licensed or accountable organizations and professionals.
Operational, not clinical, role
Elizian coordinates execution; it does not replace the clinical workforce.
Provider Governance
Governance of provider information, capacity, and qualification through configurable workflows.
Provider data and capacity governance
Define ownership, update sources, qualification responsibilities, and review requirements for provider information and reported capacity.
Attributable provider actions
Review which provider actions are recorded, how the responsible party is identified, and what evidence is available for the configured workflow.
Compliance
Controls designed to support client obligations. Specific certifications are listed only when verified and approved; none are currently claimed here.
Supports client obligations
Controls are designed to help clients meet their regulatory and contractual obligations. Elizian does not claim specific certifications unless verified and approved.
Regional regulatory scoping
Applicable regional requirements are assessed for the engagement and remain subject to responsible legal, regulatory, and customer review.
Security Documents
Requesting security documentation, vendor-management questionnaires, and due-diligence materials.
Security documentation on request
Request information relevant to the evaluation. The team confirms which materials exist, their applicable scope, and any confidentiality requirements.
Vendor-management questionnaires
Due-diligence questionnaires are supported through the security team.
Accessibility statement
Elizian's current design and development target is WCAG 2.2 Level AA, supported by semantic structure, keyboard navigation, and reduced-motion practices.
Read the Accessibility StatementEnterprise Security Documentation
Use these request pathways to identify the information your evaluation needs. The team will confirm document availability, relevant scope, and confidentiality requirements; these are not immediate downloads.
Security Overview
Ask about the security model and applicable control scope.
RequestArchitecture / Data Flow Overview
Request information about architecture and data flows relevant to the evaluation.
RequestAccess Control Overview
Ask about configured identity, authentication, and access boundaries.
RequestIncident Response Summary
Ask about applicable detection, escalation, and notification responsibilities.
RequestBusiness Continuity Summary
Ask about continuity, recovery responsibilities, and any agreed objectives.
RequestPrivacy / Data Processing Information
Ask how information is handled and which privacy terms apply.
RequestAI Governance Summary
Ask about human review, decision ownership, and applicable AI boundaries.
RequestSubprocessor Information
Ask which service providers and processing activities are relevant to the engagement.
RequestBAA Information
Ask whether a Business Associate Agreement is applicable to the proposed service and what terms require review.
RequestSecurity Questionnaire Contact
Identify vendor-management questions and the scope of the security evaluation.
RequestReady to request security documentation?
Submit a request and our security team will confirm available materials and applicable confidentiality requirements.