What it is and what it is not
Dedicated infrastructure means each customer has their own server, with their own database, and no other customer shares that machine or that data. It is not a SaaS with one table per customer, nor a “tenant” inside a shared system: it is a separate deployment.
We do not use the managed services of the big cloud providers either. The whole system, database included, runs on machines we administer. That forces more operational work on us; in return, we know exactly where every piece of data is and who can touch it.
Where it runs today
Our own nodes, development and SARI’s voice gateway, are in Helsinki, inside the European Union. The United States telecoms operator that uses Sariphone runs its phone system on its own infrastructure, in the United States. And we have our own capacity in Germany, not in production today, brought up when a customer requires data residency there.
There is one rule: the node goes where the customer needs it. A clinic in Colombia, an operator in the United States and a practice in Germany have no reason to share a country, let alone a server.
Why it matters in healthcare
A clinical record has a legal controller, and that controller is usually the clinic, not the software vendor. When the data sits on a dedicated server, the clinic can state where it is, who accesses it and under which controls, without depending on the policies of a third party serving thousands of customers at once.
In Sarident that comes with controls inside the system: personal data encrypted field by field, an append-only audit trail with integrity hashes, two-factor authentication and role-based access. They are implemented; they are not certified or audited by third parties, and we say so.
Why it matters in telephony
A call answered by SARI is recorded on separate channels, transcribed and scored. That is the customer’s business information: who called, what they asked, how they were served. In a dedicated deployment those recordings never leave the customer’s node nor mix with anyone else’s, and the customer decides how long they are kept.
What we do not promise
- ×We do not promise “compliance” by virtue of using the product. Regulatory conformity is defined and validated with each customer, on each deployment.
- ×We do not promise zero risk. We apply access controls, encryption in transit, operational logs and backups, and still no system can promise that.
- ×There is no self-service: a dedicated deployment is set up per project, which is why there is no sign-up or card payment on this site.
How to check
Ask where the node is, who administers the database and what happens to the data when the contract ends. Any vendor should be able to answer all three in one sentence each. We answer them in writing before starting.