Audit & Compliance
The Patholytix platform is used in GLP-regulated environments and processes personal data subject to EU/UK GDPR. Every authenticated API call produces an audit event identifying the client, the operation, and the affected resource.
Audit events by operation
Study API
| Operation | Audit event |
|---|---|
Create a study (POST /studies) | STUDY_CREATED |
Update a study (PUT /studies/{id}) | STUDY_UPDATED |
Delete a study (DELETE /studies/{id}) | STUDY_DELETED |
| Create a subject, organ, or codes record | STUDY_UPDATED |
| Update a subject, organ, or codes record | STUDY_UPDATED |
| Delete a subject or organ | STUDY_UPDATED |
Start a study export (POST /exports) | CLIENT_STUDY_EXPORT |
Download an export file (GET /exports/{id}:download) | CLIENT_STUDY_EXPORT |
Read or list any resource (GET) | CLIENT_ACCESSED_STUDY |
| Any request rejected (400, 403, 404, 422) | CLIENT_ACCESSED_STUDY_FAILURE |
Cloud Image API
| Operation | Audit event |
|---|---|
Start an ingest job (POST /image/jobs:ingest) | IMAGE_JOB_CREATED |
Start a transfer job (POST /image/jobs:transfer) | IMAGE_JOB_CREATED |
Retry a job (POST /image/jobs/{id}:retry) | IMAGE_JOB_RETRIED |
Cancel a job (POST /image/jobs/{id}:cancel) | IMAGE_JOB_CANCELLED |
| Job reaches a terminal state (COMPLETED, FAILED, PARTIAL) | IMAGE_JOB_COMPLETED |
Write operations (POST, PUT, DELETE) and failure events are recorded as part of the request lifecycle. Read access events (CLIENT_ACCESSED_STUDY) are recorded asynchronously and, while expected to be captured for all operations, may not be guaranteed in the event of infrastructure unavailability.
The CLIENT_ACCESSED_STUDY_FAILURE event is recorded for any rejected request — including resources not found, insufficient permissions, invalid identifiers, and business rule violations such as attempting to delete a subject that still has organs registered under it.
GLP context
Good Laboratory Practice (GLP) requires that systems used in regulated studies maintain a complete audit trail of all data-affecting operations.
- Every write and read operation is attributable to the
clientIdthat performed it - Audit records cannot be deleted or modified via the API
- Audit log retention is governed by Deciphex's data retention policy — contact your account representative for details
GDPR context
The Patholytix platform is designed to support EU/UK GDPR compliance. Integration clients are responsible for ensuring their use of the API — including any personal data transmitted in study attributes — is consistent with their own GDPR obligations and data processing agreements with Deciphex.
Regulatory status
Additional regulatory certifications are under review. Contact your Deciphex account representative for the current compliance documentation applicable to your organisation.