Yellow fibre cables plugged into a network switch

The stack behind the Dules.

duleOS is built cloud-native on GCP, event-driven across independent services, and ABDM-integrated from the first commit.

Explore the platform Security and compliance

Architecture

Independent services. Event-driven. Cloud-native.

Each Dule runs on independent Node.js services on GCP Cloud Run. Services talk through an internal event bus rather than calling each other directly. Angular frontends are server-rendered and served from a global CDN. MongoDB Atlas holds clinical data in an India region.

Compute
GCP Cloud Run
Containerised, autoscaling Node.js services in the Mumbai region, each deployable on its own.
Events
Event-driven services
Clinical events (consult completed, prescription issued, bed allocated) are published to an internal bus. Services subscribe and react independently.
Data
MongoDB Atlas
Per-tenant encrypted collections in an India region, with automated backups, point-in-time recovery and audit change streams.
Web
Angular and server rendering
Server-rendered Angular apps on Firebase Hosting, so pages arrive readable on a modest connection.

Go deeper

Seven pages,one stack.

Each layer of duleOS has its own page: what it is, how it is built, and what it means for a clinic.

ABDM and ABHA built in, not bolted on
AI that assists and never decides
Offline-first on web, Android and iOS

Start with the platform overview

A bright data hall with rows of equipment cabinets

Platform overview

Four pillars, one foundation.

Soft arcs of amber light on a dark background

AI diagnostics

AI that assists. Doctors who decide.

Orange fibre leads plugged into a dark equipment chassis

Services architecture

Independent services, one patient record.

A ring of old keys hanging on a wooden wall

Security

Zero-trust by default.

ABDM integration

ABDM-native, not ABDM-bolted-on.

A phone held up over a rooftop view of an Indian town

Mobile and offline

Works where India works.

Red archive binders with barcode labels on a shelf

Compliance and trust

The standards we build to, stated plainly.

Security and compliance

Patient data protection is not a feature. It is the foundation. We are not yet certified to ISO 27001 or SOC 2 and do not claim to be: the compliance page sets out the path.

PHI handling aligned with US healthcare privacy standards
India Digital Personal Data Protection Act 2023
Built on the Ayushman Bharat Digital Mission rails

PHI encryption at rest

Patient records are encrypted at rest in MongoDB Atlas, with per-tenant keys.

Zero-trust network

Services authenticate to each other. No service trusts another by default.

Secret Manager

Credentials, API keys and certificates live in GCP Secret Manager, never in code.

Security monitoring

GCP Cloud Audit Logs and monitoring for continuous threat detection.

Transparency

Questions about oursecurity posture?

We share our security architecture with enterprise prospects under NDA.

Request a security brief Data security statement