See it end to end.
A real records-exchange, step by step — the exact flow our end-to-end test suite proves. Meet Dr. Alice at a clinic running Entropa Private, and follow one patient record from sealed to served.
Passwordless sign-in
Dr. Alice authenticates with her post-quantum key, not a password. She proves she holds the key by signing a fresh single-use challenge — nothing secret ever crosses the wire. Phishing-resistant by construction.
A record is sealed — on the clinic's side
The clinic seals a patient chart with ML-KEM-1024 + AES-256-GCM before it ever leaves. Entropa receives only ciphertext and a fingerprint — not even we, or the cloud, can read the record.
Filed & hash-linked
The record is PQC-signed and hash-linked into an append-only ledger. From this instant it can never be altered, reordered, or backdated without breaking the chain.
Independently attested & anchored
A separate cryptographic Attestation Authority co-signs a checkpoint, anchored to a trusted external timestamp — so not even the clinic can rewrite its own history.
Access is delegated — the nurse is refused and flagged
The clinic re-wraps the record's key for Dr. Alice — without ever sharing its own key or exposing the record. An unauthorized nurse who tries to retrieve it is refused — and her attempt is flagged on the immutable ledger, with exactly who tried. Every access attempt, authorized or not, is recorded: full accountability, zero trust, nothing dropped.
Retrieved & logged — who touched what
Dr. Alice opens the record with her own key. Her access is written to an immutable disclosure ledger — the tamper-proof accounting of who touched which record, when, and why. A log the watched cannot rewrite.
Recoverable — never lost
If a key is lost, a quorum of the clinic's own custodians (any 3 of 5) restores it. No single party — not even Entropa — can recover it alone.
Provable forever
Every step is quantum-safe and verifiable by any auditor, for decades. Confidentiality holds throughout: an outsider — even one with a valid key that isn't the owner or a grantee — can read nothing.
Your own Entropa, deployed where your data lives.
We implement Entropa privately inside your network — a dedicated instance in your VPC or on-prem: your own Clientropa. Every employee action on your records then runs through an immutable, tamper-evident audit trail that even your own administrators can't rewrite. That's audit controls of immutability far beyond what a database or EMR can offer: not "trust our logs," but cryptographic proof of who touched which record, when, and why — a record the watched cannot alter, and neither can we.
Deployed in your walls
Your dedicated Entropa runs in your own environment — your data never leaves your control, and integrates with the systems you already run.
Insider-proof accountability
The classic problem — a privileged insider quietly editing the log of their own access — is impossible here. The audit trail is append-only and cryptographically sealed.
Provable compliance
Turn "we have audit controls" into "here is cryptographic proof our controls were never altered" — the evidence an auditor, a regulator, or a court can independently verify.
Works with your EHR
Entropa is designed to fit alongside the record system you already run — Epic, Oracle-Cerner, athenahealth, and more — via the FHIR standard. Your team keeps their workflow; you gain the immutable, provable audit and integrity layer beneath it. (EHR integration is on our roadmap; direct upload works today.)
This isn't a mockup.
Every step above is the exact flow our end-to-end test suite runs and proves — passwordless auth, sealing, filing, attestation + anchoring, delegation, authorization, immutable disclosure, and threshold recovery, all composed and green. The cryptographic core is built in Rust and verified by an invariant test suite; the full managed platform is in active development.