Home Platform Solutions Why Stream Security Contact

Security

Every request checked. Every action logged.

Emergency data crosses agency lines, so Stream checks who you are, what you are allowed to touch and which agency owns the data on every single request. Then it writes the result down.

RequestUpdate St. Brendan's ED status
  1. IdentityPasskey verified for p.raman
  2. PermissionsPlanning chief, scope Riverside County
  3. Tenant isolationRow-level security, tenant harbor-county
  4. EncryptionTLS in transit, encrypted at rest
  5. AuditEvent written to the audit log
Watch a request pass through each layer.
Request the security packet See all controls

Tenant isolation

Every agency gets its own lane. Sharing is a written agreement.

Agencies run side by side on one platform, but row-level security keeps each tenant's records apart. Data crosses between them only through a data agreement that names exactly which fields are shared.

TENANT northside-health

Northside Medical Center

ED statusshared
Med/surg beds openshared
ICU beds openshared
Patient recordsprivate
Staff rosterprivate
Internal incident logprivate
Agreement DA-0042 Northside to Tri-River HCC
  • ed_status
  • medsurg_open
  • icu_open
  • patient_records
  • staff_roster
Signed by both agencies. Revocable.
TENANT tri-river-hcc

Tri-River Healthcare Coalition

Northside ED statusDA-0042
Northside bed countsDA-0042
Regional status boardprivate
Member contactsprivate
Exercise plansprivate
No agreement.
Nothing crosses.
TENANT harbor-county

Harbor County OEM

Incidents and IAPsprivate
Shelter capacityprivate
Alert groupsprivate
Resource requestsprivate
Stream platformRow-level security on every tableTenant id checked on every queryAgreements logged and revocable

Permissions

Scopes as narrow as one board

Roles decide what someone can do. Scopes decide where. Pick a role to see how much of the region it can reach.

Hospital or clinic Shelter EOC EMS or long-term care

State coordinator

scope: region/* (read), boards/regional (write)

Can see

    Can change

      Cannot see

        Magic links

        A link that opens one board, once, for a short time

        Partners update status without an account. Each link goes to whoever is on duty, unlocks a single board and stops working on its own.

        1. 01Issued

          Created for the Lakeview Regional ED status board only.

        2. 02Delivered

          Sent by SMS to the on-duty charge nurse from the roster.

        3. 03Opened

          Opens the one board. No other pages, no search.

        4. 04Board updated

          ED set to Advisory, 9 beds. Written to the audit log.

        5. 05Expired

          The link stops working. Reuse attempts are refused and logged.

        Clock
        14:02:00
        Link
        strm.ing/k7Qp2
        Scope
        lakeview / ed-status
        Recipient
        on-duty charge nurse
        Lifetime shown is an example.

        Audit log

        Who did what, when and from where

        Every change, sign-in, link use and permission denial lands in an append-only log you can filter and export for your after-action review.

        Streaming sample events
          0 events shownExport CSV or JSON for your AAR

          Resilience

          Your whole configuration lives in git

          Boards, roles, alert groups and portal pages are kept as files in version control. If a region goes down, the same configuration deploys to another one.

          tenant-configs/harbor-county

          • boards/ hospital-status.yaml, shelters.yaml
          • roles/ planning-chief.yaml, partners.yaml
          • alerts/ on-duty-supervisors.yaml
          • agreements/ da-0042.yaml
          • portal/ public status pages
          Reviewed in pull requests. Every change has an author.

          Deploy from git

          Same files, any region. Nothing is configured by hand.
          • Apply boards
          • Apply roles and scopes
          • Apply alert groups
          • Apply agreements and portal
          Primary regionSERVINGLive tenant traffic
          Recovery regionSTANDBYReady to receive configuration
          Simulation for illustration. Recovery targets are set per contract.
          1. Press the button to walk through a recovery drill.
          Per contractRecovery point objectiveSet in your service agreement
          Per contractRecovery time objectiveSet in your service agreement
          GitSource of tenant configurationRestores boards, roles, alerts and portal

          Controls

          Security controls at a glance

          Sign-in
          Single sign-on with Microsoft Entra ID, passkeys (WebAuthn) and multi-factor authentication.
          Permissions
          Roles plus scopes down to a single facility or board. Denials are logged.
          Encryption
          Encrypted in transit and at rest. Integration credentials use KMS envelope encryption.
          Audit
          Every change, sign-in and magic link use is recorded and exportable.
          Isolation
          Row-level security separates each agency's data. Sharing happens only through data agreements.
          Recovery
          Tenant configuration lives in git and can be redeployed to another region.

          Compliance documentation available on request. Security questionnaires, architecture details and policies are shared under NDA during procurement.

          Request the security packet