Briefing 06: Engineered for Trust

Part 6 of 6 · The Technology Behind Better Outcomes — a technical briefing series from Quill Direct Vet Care.

In regulated distribution, the security review is the sales cycle. A platform that sits between a licensed practice, a regulated carrier, and a consumer’s payment instrument does not get evaluated on its interface — it gets evaluated on whether a vendor risk team can approve it. Quill Direct Care was architected with that review as a design input, which is why the controls in this article are structural rather than compensating.

1. The threat model

Quill’s platform concentrates four categories of sensitive data that are rarely found together, and the architecture is organized around that concentration:

2. Network architecture: no public data plane

The controlling decision in Quill’s infrastructure is that the data plane has no public presence. Application services run inside a virtual network; the data services they depend on are reachable only from inside it.

• Private endpoints with private DNS. Search and the vault resolve to private addresses inside the VNet. Public network access is disabled at the service, so a stolen key is unusable from outside — a property Quill has verified operationally, not just configured.

• Deterministic egress. All outbound traffic leaves through a NAT gateway on one static IP. That address is the sole entry on the database firewall, the vault allow-list, and partner webhook allow-lists. Unexpected egress is therefore immediately anomalous.

• Deny-by-default vaults. Key Vault network rules default to Deny with an explicit allow list, with soft-delete and purge protection enabled so a destructive action is recoverable.

• No public administrative access. Database and host administration run through a bastion-tunneled jump host. There is no internet-facing SSH port and no publicly reachable database endpoint.

3. Identity: credentials that do not exist cannot leak

The most common cause of cloud compromise remains a credential in the wrong place — a key in a repository, a connection string in an image, a service principal secret in a CI variable. Quill’s design goal is to minimize the number of long-lived secrets that exist at all.

Least privilege, applied to people as well as services

External contractors receive guest identities placed in a purpose-scoped group with only the roles their work requires, reaching the database exclusively through a bastion tunnel and a matching database role. Access is granted per engagement and revoked with the engagement — a group membership change, not a credential rotation exercise.

4. Authorization enforced by the database

Application-layer authorization is necessary and insufficient. A single missing filter in one query handler is a cross-tenant breach in most multi-tenant systems. Quill enforces scoping one layer lower, in PostgreSQL row-level security policies evaluated by the database engine itself.

• Policies scope rows by authenticated identity, tenant, and role for every table holding clinical, financial, or personal data.

• Role membership is held in a dedicated roles table — never as a mutable attribute on a user or profile record — and evaluated through a security-definer function, which is the standard mitigation against privilege-escalation via self-service profile edits.

• Explicit grants are issued per table per role, so access is affirmative rather than inherited by accident.

• Personally identifiable fields are masked in interfaces where full values are not operationally required.

• The result is a hard floor: an application bug becomes an error, not a disclosure.

5. Auditability

Every consequential action in the platform produces an immutable record with actor, timestamp, and before/after state — clinical note signature, claim state transition, ledger posting, role assignment, coverage determination, and AI-assisted recommendation alike.

AI actions are audited to the same standard as human ones. Each generated output carries its model deployment, prompt version, retrieval trace identifier, and the resolved source set, so an answer produced eighteen months ago can be reconstructed exactly. Auditability of automated decisions is rapidly becoming a procurement requirement rather than a differentiator, and retrofitting it is substantially harder than designing for it.

6. Resilience and operations

• Database durability. Zone-redundant high availability with point-in-time restore on the managed PostgreSQL service.

• Stateless compute. Application containers hold no durable state, so a revision can be replaced or rolled back without data risk.

• Immutable, versioned deployments. Every release is a tagged image in a private registry pulled by managed identity; rollback is a revision pointer change.

• Scale-to-zero batch. Ingestion and maintenance run as event-driven container jobs that consume nothing when idle — a cost control that is also a reduced attack surface.

• Cost governance as a control. Budget alerts, log-ingestion caps, and periodic spend review are treated as operational controls; unmonitored spend is how surprise infrastructure appears, and surprise infrastructure is how unmonitored exposure appears.

• Documented configuration. The full infrastructure configuration — including the exact commands used and the reasoning behind each decision — is maintained as a living operational runbook, which is what makes disaster recovery a procedure rather than an archaeology project.

7. Compliance posture, stated precisely

Quill is deliberate about what it claims, because overstatement is itself a due-diligence failure:

• HIPAA governs human protected health information and does not, as a matter of law, extend to veterinary records. Quill engineers to HIPAA-equivalent technical safeguards because its buyers’ security programs are written that way and because the personal and financial data in the platform warrants it — not because a statute compels it for animal health data.

• SOC 2 Trust Services Criteria provide the control framework Quill’s design is mapped to: security, availability, processing integrity, confidentiality, and privacy.

• Payment data is handled through certified processors; Quill’s ledger records movement and reconciliation rather than storing raw instrument data.

• AI data handling rests on a published commitment from the platform operator that prompts, completions, and embeddings are not used to train or improve foundation models, reinforced by Quill’s own network isolation so the commitment is not the only control.

8. Why this is commercially decisive

Security architecture is usually presented as a cost center. In this market it is the distribution channel. A carrier’s vendor risk team will ask where the data lives, how identity is federated, whether the data plane is publicly reachable, how automated decisions are audited, and how contractor access is scoped and revoked. A vendor who answers those questions with a diagram and evidence moves to contracting. A vendor who answers with intentions does not move at all.

Every control described here already exists in Quill’s deployed environment, was implemented and verified operationally rather than asserted in a policy document, and is recorded in a configuration runbook with the exact commands and reasoning behind each decision. That evidence base is not a byproduct of the build — it is one of the assets.

SOURCES

References.

1. Microsoft, “Data, privacy, and security for Azure OpenAI in Azure AI Foundry Models,” Microsoft Learn (accessed August 2026). Confirms that prompts, completions, embeddings, and training data “are NOT used to train, retrain, or improve” the base models and are not shared with other customers or with OpenAI. https://learn.microsoft.com/en-us/azure/ai-foundry/responsible-ai/openai/data-privacy
2. Microsoft, “What is Azure Private Link?” Microsoft Learn. Private endpoints place a PaaS service on a customer VNet address and remove exposure to the public internet. https://learn.microsoft.com/en-us/azure/private-link/private-link-overview
3. Microsoft, “Managed identities for Azure resources,” Microsoft Learn. Eliminates stored credentials for service-to-service authentication. https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview
4. Microsoft, “Azure Key Vault soft-delete and purge protection,” Microsoft Learn. https://learn.microsoft.com/en-us/azure/key-vault/general/soft-delete-overview
5. GitHub, “Configuring OpenID Connect in Azure,” GitHub Docs. Federated workload identity removes long-lived cloud credentials from CI/CD. https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-azure
6. Lewis et al., “Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks,” NeurIPS 2020. arXiv:2005.11401. Establishes retrieval grounding as a method for producing more specific, diverse, and factual generation than a parametric-only model. https://arxiv.org/abs/2005.11401
7. AICPA, “SOC 2® — SOC for Service Organizations: Trust Services Criteria.” The audit framework Quill’s control design is mapped to. https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2
8. U.S. Department of Health & Human Services, “Covered Entities and Business Associates.” Establishes the scope of HIPAA, which applies to human protected health information; Quill adopts equivalent controls as an engineering benchmark rather than as a veterinary legal requirement. https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html
9. Ülkir M, Paslı B, “Reference Hallucination, Citation Reliability, and Readability of Large Language Models in Anatomy-Related Question Answering,” Clinical Anatomy, 2026. DOI: 10.1002/ca.70187. https://doi.org/10.1002/ca.70187
10. Microsoft, “Hybrid search — Azure AI Search,” Microsoft Learn. Describes Reciprocal Rank Fusion over parallel vector and keyword (BM25) result sets, and semantic reranking. https://learn.microsoft.com/en-us/azure/search/hybrid-search-overview
11. Microsoft, “Jobs in Azure Container Apps,” Microsoft Learn. Scheduled and event-driven containerized jobs with scale-to-zero. https://learn.microsoft.com/en-us/azure/container-apps/jobs
12. Wang D, Ye J, Li J, et al., “Enhancing Large Language Models for Improved Accuracy and Safety in Medical Question Answering: Comparative Study,” Journal of Medical Internet Research, 2025. DOI: 10.2196/70190. https://doi.org/10.2196/70190
13. Radford et al., “Robust Speech Recognition via Large-Scale Weak Supervision” (Whisper), 2022. arXiv:2212.04356. https://arxiv.org/abs/2212.04356
14. Scoresby K, Jurney C, Fackler A, Tran CV, Nugent W, Strand E, “Relationships between diversity demographics, psychological distress, and suicidal thinking in the veterinary profession: a nationwide cross-sectional study during COVID-19,” Frontiers in Veterinary Science, 2023. DOI: 10.3389/fvets.2023.1130826. https://doi.org/10.3389/fvets.2023.1130826
15. Rotenstein LS, Holmgren AJ, Thombley R, et al., “Changes in Clinician Time Expenditure and Visit Quantity With Adoption of Artificial Intelligence-Powered Scribes: A Multisite Study,” JAMA, 2026. DOI: 10.1001/jama.2026.2253. https://doi.org/10.1001/jama.2026.2253
16. North American Pet Health Insurance Association (NAPHIA), “Industry Data — State of the Industry.” NAPHIA members and report participants represent 99% of policies in effect in North America; insured-pet counts and gross written premium growth are as published in the current edition. https://naphia.org/industry-data/
17. ASC X12, “X12 EDI Standards” — the 837 (claim), 835 (remittance advice), 270/271 (eligibility inquiry and response) transaction sets used across insurance claim exchange. https://x12.org/products/transaction-sets
18. HL7 International, “FHIR (Fast Healthcare Interoperability Resources) R4 Specification.” https://hl7.org/fhir/R4/
19. PostgreSQL Global Development Group, “Row Security Policies,” PostgreSQL Documentation. Row-level security enforced by the database engine rather than by application code. https://www.postgresql.org/docs/current/ddl-rowsecurity.html
20. Microsoft, “High availability and disaster recovery — Azure Database for PostgreSQL flexible server,” Microsoft Learn. Zone-redundant HA and point-in-time restore. https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-high-availability
21. Awawdeh L, Waran N, Forrest RH, “Aotearoa New Zealand pet guardians’ attitudes towards the financial cost of pet care,” Animal Welfare, 2025. DOI: 10.1017/awf.2025.10048. https://doi.org/10.1017/awf.2025.10048
22. Szlosek D, Coyne M, Riggott J, Knight K, McCrann DJ, Kincaid D, “Development and validation of a machine learning model for clinical wellness visit classification in cats and dogs,” Frontiers in Veterinary Science, 2024. DOI: 10.3389/fvets.2024.1348162. https://doi.org/10.3389/fvets.2024.1348162