AI governance for hospitals · Built in Western Australia
Tavrik sits inside your network. It replaces patient details before any AI tool sees them, enforces your policy on every request, and writes the evidence into the audit systems you already run. With a local model, nothing leaves the building at all.
Talk about a pilot Read how it works →
No inbound path from the internet. Outbound connections only.
A clinician pastes a handover note into ChatGPT. Before it leaves the hospital network, Tavrik replaces the patient details with placeholders. The AI answers normally. On the way back, the real details are restored. The provider never received them.
Mrs Eleanor Whitfield, MRN 4471902,
DOB 12/03/1948, presented with…{NAME_1}, MRN {MRN_1},
DOB {DOB_1}, presented with…request allowed · 3 items replaced
NAME, MRN, DOB · policy v3
delivered to Mirth and FHIR AuditEventThe same policy applies whether the request came from the browser extension or from an application through the API gateway. Prompts and answers are not stored. What is recorded is that a request happened, what kinds of details were found, and whether it was allowed.
The console shows what is flowing through, what was replaced, where it was routed, and why it was allowed or blocked. Every screen below is the live product, not a mockup.
Evidence goes where your existing processes already look for it, rather than into another console nobody opens.
Audit events delivered as HL7 v2 messages over MLLP with TLS, to the integration engine you already run — Mirth Connect, Cloverleaf, Rhapsody and Iguana are the common ones — and your integration team routes them like any other feed.
FHIR R4 AuditEvent resources over HTTPS. Audit records only. Tavrik does not read or write clinical resources.
Splunk HEC, Microsoft Sentinel and Microsoft Purview. The same categorical events, in the tools your security team already watches.
Dedicated single-tenant cloud in your region, an on-premises VM in your data centre, or your Kubernetes cluster. Inside your network either way, with the option to route to a local model so patient data never leaves at all.
We maintain control mappings for SOC 2, ISO 27001, HIPAA, the Australian Privacy Act and the EU AI Act. We do not yet hold a SOC 2 or ISO attestation; a SOC 2 Type I is in progress.
Tavrik is founder-led, and we are taking on our first hospital design partner. There are no public reference customers yet.
Every claim on this page is listed with its evidence in the repository, and the build fails if a number appears without one. Ask and we will demonstrate it live.
Four weeks, one department, real clinicians. We install inside your network, enrol a pilot group on the browser extension, connect the audit path to your integration engine or FHIR store, and hand you the evidence at the end. You keep the audit log either way.