Pseudonymous by design
Session tokens, never identities. No names, no e-mails, no patient accounts anywhere in the delivery pipeline.
Solutions · Medical video
Per-viewer failover.
Medical video that must not drop.
The requirement
Reliability here is clinical, not cosmetic.
A tele-health consult or a surgical stream does not get a second take. A frozen frame is not an annoyance to be averaged into a QoE score; it is an interrupted procedure. Per-viewer mid-stream switching keeps a session alive across a CDN failure without anyone at either end touching anything — the source switches behind the buffer, and the consultation continues.
The boundary
Raw session data stays in your account.
Deployed BYOC, the delivery stack and the raw telemetry store run in your own cloud account, under your own keys. Routing decisions run in-server; viewer signals are not shipped to external AI systems. The data-residency conversation with your compliance office starts from “it never left” rather than from a processing agreement about where it went.
- Raw session events live in your account, with retention you set.
- Decisions are computed in-server, on the serving path, not in a third-party analytics cloud.
- No model trains on your traffic without a signed, scoped, revocable data-sharing addendum.
The pipeline
Privacy is in the pipeline, not just the policy.
Geography, not location
Location is kept at geography level. The routing needs a region and a network, and that is all it stores.
Append-only audit trail
Privacy-relevant actions — including our own operators viewing your account — land in an immutable audit log.
Keep the session alive. Keep the data home.
Walk your compliance office through an architecture that never asks them to trust us with raw data.