Capability
Many sites, one record.
A group runs as one tenant with one record across every site, rather than one deployment per site that has to be reconciled later.
One tenant, many sites.
A group that deploys a separate system per site inherits the patchwork problem at a larger scale.
The same patient exists several times, no site can see the whole history, and the group can neither compare two units nor move a patient between them without a transcription. Every acquisition adds another version of the truth to reconcile.
Pensieve holds one record for the group, and each site works inside it. Federation here is a property of the tenant rather than a synchronisation job between tenants: there is no nightly reconciliation, because there is nothing to reconcile.
Identity is the part that carries the most weight. One person is one record across every site in the tenant, so a patient seen at a peripheral unit and admitted at the flagship is the same object in both, with the same allergies and the same history attached.
The shape
Peer sites, one governed record
What is shared, and what stays local.
The record is shared
One patient, one identity, one history, one authorization plane and one audit trail across the tenant. Those five are the things a group cannot usefully hold twice, and they are exactly the things that a per-site deployment splits.
The structure is local
A site is a modelled object in Nexus, and so is everything inside it: the wards and theatres, the teams, the physical assets, the services, the duty roster. Two sites in one tenant can be organised nothing like each other, because the shape of a site is data rather than a build.
So is the way the site works
The order catalogue a clinician picks from, the forms staff build, the operational processes an administrator designs and the pricing rules the finance office approves all belong to the site that runs them. A group standard is a choice a group makes. The platform never imposes one because it failed to model the difference.
Crossing a site boundary is a decision each time
A clinician at one site reading a record written at another is an authorization decision like any other: computed by Cirith from the relationship, the consent and the admission, and written to the access log with the rest. There is no group-wide role that quietly sees everything, and no site-to-site export for anyone to lose.
What stays inside the estate
The machines stay where they are. Analysers, imaging modalities, pharmacy systems and whatever hospital software a site already runs sit on that site’s internal network and are never exposed to the internet.
What is added inside the building is one binary. The orophin bridge runs on a Windows PC or a Linux server inside the estate, speaks MLLP and HL7 v2, ASTM, DICOM, file drops and database polling, and opens a single outbound, mutually authenticated connection to the platform. No inbound port is opened and no listener is exposed, so a network team approves egress rather than an inbound rule.
The bridge holds a durable outbox. If the link drops, machine traffic queues locally and delivers on reconnect instead of being lost. We are direct about where that guarantee stops: the staff application is a cloud application and needs connectivity, and it is the machine traffic that survives an outage.
One bridge per estate carries many connections, and Westron is where a group’s own team configures and watches every one of them, site by site.
Custody
Three arrangements, one unchanged half
Who holds what, in each arrangement
| Arrangement | Infrastructure held by | Record held in | Status |
|---|---|---|---|
| Pensieve-managed cloud | Pensieve, on Google Cloud in region asia-south1 (India). | asia-south1, co-located with the database. | Running today |
| Your own cloud tenancy | The institution. Your project, your billing, your identity and access management. | Wherever your tenancy is provisioned. It stays inside yours. | Not offered today |
| Hardware in your building | The institution, on hardware inside the estate. | Your building. | Not offered today |
The second and third are mechanically ordinary: the backend is a container image, the staff application is static files, and the bridge is unchanged wherever the backend sits. That the software can be placed there is a property of the artifacts. Whether we will contract to place it there is a commercial commitment, and this page will not publish one before it is real. The full statement of what runs where is at cloud.
Beyond the group.
Sharing runs on the standards the rest of healthcare uses
A group does not treat every patient it will ever see. Records leave and arrive over HL7 v2, FHIR R4 and DICOM, and over the national exchange and consent manager where a hospital is registered for them, under the patient’s own consent rather than under a bilateral agreement between two vendors.
The exit is a property of the same architecture
Because Pensieve reads those standards, it writes them. A group’s record is exportable on the formats it arrived in, which is why the exit stays visible for the whole time an institution is inside rather than becoming a negotiation at the end of a term.