Home / Learn / Architecture diagrams
CIOs, architects and integration engineers

Architecture diagrams

The drawings our engineers use. Where each part of HealthOS runs in your cloud tenancy, how one request is held to one organisation, and how connectors move data in and out.

Talk to an engineer How it works
Deployment

What runs where

Only the web containers take traffic from the internet. Each serves its app and forwards API calls to a backend that has no public address.

Integration clients Power Platform, flows Clinicians & office staff portal Administrators admin console Field workers HealthOS Worker Patients & families HealthOS Connections YOUR CLOUD TENANCY HTTPS PUBLIC Integration edge allow-listed, rate limited Staff web serves the staff portal and admin console · security headers Worker web installable mobile app Connections web patient and family portal forwards API calls INTERNAL ONLY HealthOS API REST and FHIR AU · tenancy checks on every route · connector framework Connections API portal backend a database role that cannot bypass row security its own narrower role DATA PostgreSQL · one governed record care delivery · care admin · aged care · acute · home care · finance · integrations · reporting · portal Every tenant row carries its organisation, and row-level security is forced on every tenant table reads and writes per organisation migrate · roll up lands inbound messages BACKGROUND Flow daemon flows, replication, claim reports, directory sync Scheduled jobs migrations · nightly analytics · report schedules HL7 gateway HL7 v2 over MLLP · optional SHARED SERVICES · MANAGED IDENTITY WHERE SUPPORTED Key Vault secrets and keys Redis cache Blob Storage documents AI Foundry model endpoints, optional Container Registry versioned images
Everything meets in one PostgreSQL record. That is why tenant isolation is enforced in the database itself and not only in application code. Every resource is defined as code, and each release rolls the API and its background workers to the same image version together.
Tenancy

One request, held to one organisation

Three checks stand between a request and a row. Each one fails closed, so a mistake shows up as missing data and never as another organisation's data.

IN THE API IN THE DATABASE Browser signed-in token chosen organisation chosen facility and ward Staff web forwards the call to the internal API security headers Sign-in check token verified roles and permissions read from it Organisation check on every tenant route caller must hold a role there facility and ward checked Scoped transaction opens a transaction pins the organisation switches to a role that cannot bypass row security Row-level security only rows of the pinned organisation are visible forced on every tenant table, owner included no or bad token 401 back to sign-in organisation not held Refused before any query runs unscoped query Zero rows no organisation, nothing matches
New records take their organisation from the verified session, never from the request body. A stale facility or ward selection is dropped, not trusted. Only a platform administrator can view across organisations, and writes from that view are refused.
Integration

How a connector moves data

Every external system plugs in the same way. A deployment loads the connectors it needs, and each organisation installs them with its own settings and credentials.

OUTBOUND Connector catalogue the connectors this deployment loads install Organisation install its own settings, encrypted its own credentials load HealthOS API builds the connector for that organisation calls External systems Services Australia Australian Digital Health Agency Health funds and payments Accounting systems Rostering and identity HL7 and FHIR feeds Devices and wearables INBOUND arrives Inbound feed webhook, HL7 or file signature checked stage Staging and mapping codes mapped to the record exceptions held for review promote The record stamped with the install's organisation
An inbound row takes its organisation from the connector install it arrived through. Nothing in the payload can place it in another tenant. A site that does not hold a licence for a connector simply does not load it, and the rest of the platform runs unchanged.