Security and data isolation
Compliance teams and auditors need to know where a pharmacy’s records live and whether they have been changed. Spomr’s design answers both questions directly.
Four design principles
Isolation, tamper evidence, stateless processing, and certificate-based access work together. None of them depends on trusting a shared table or a shared process.
-
One database per pharmacy
Each pharmacy has its own physically separate SQLite database on Cloudflare D1. No table holds several pharmacies’ records, so one pharmacy’s queries never touch another’s rows.
-
Tamper-evident ledger
Every write appends an entry whose SHA-256 hash covers its payload, its timestamp, and the hash of the entry before it. Changing a past entry breaks every link after it, so alterations can be found by recomputing the chain.
-
Stateless edge processing
Requests run on Cloudflare Workers in isolated V8 sandboxes. Nothing is held in memory between requests; durable state lives only in the tenant and control-plane databases.
-
Certificate-based access
Mutual TLS is enforced at Cloudflare’s edge. Only client certificates registered for a pharmacy can reach its endpoints, and certificates can be bound to hardware tokens such as YubiKey PIV smart cards.
From request to recorded entry
The path a write takes, from the client’s certificate to the ledger.
-
Client certificate
Presented over mutual TLS at the edge.
-
Edge check
The certificate thumbprint is matched against the control plane.
-
Tenant routing
The Host header identifies one pharmacy’s subdomain.
-
Tenant database
The request reads or writes that pharmacy’s database only.
-
Ledger entry
The change is appended with a chained hash.
Spomr supports your compliance program. It does not replace your own policies, system validation, or review by your quality and regulatory staff.
Questions about our architecture?
Send us your security review questions and we will answer them before a demo.
Contact us