AURORA's privacy posture is structural: federation by default, no central data lake, signed updates between sites, opt-in telemetry. This page explains the rules in plain language.
AURORA does not collect patient data. Pilot sites run AURORA on-prem or inside their own VPC. The federation runtime traverses signed model updates between sites; it does not move patient records. Differential-privacy budgets are enforced per registry; auditing is on by default.
The website you are reading uses no cookies for analytics, no fingerprinting, no third-party trackers. The only external assets are Google Fonts and the unpkg-hosted React/Babel CDN — both content-pinned with subresource integrity hashes.
Federation does not need open inbound ports. Sites open an outbound mTLS connection to the federation control plane.
Every model update is Sigstore-signed. The audit log records which site contributed which update, when, on what hash.
Differential-privacy budgets are configured per registry and enforced by the runtime. Budgets surface in the audit log.
Cohort policies travel with the data. Subsystems refuse to run on records that lack the matching consent.
Full air-gapped Helm and OCI bundles are first-class. Telemetry is opt-in and off by default.
Pinned commit + container digest + weights hash + dataset hash. Every run is re-runnable, every artefact attributable.
If you are a patient whose data sits in a pilot-site registry, your rights run through that institution under its local law (GDPR, HIPAA, India DPDP, etc.). AURORA's substrate does not change those rights. We strongly support them.
If a pilot site runs AURORA on your data, the institution still owns the relationship with you. We will not, and structurally cannot, override that.