ICU data architecture: replication, security and isolation

PostgreSQL architecture across three zones: real-time processing, encrypted flows, a fully open-source foundation and readiness for evolving AI

TARGET TOPOLOGY

One responsibility per execution zone.

The clinical PROD database replicates its data through encrypted WAL to a read-only copy. This is the only database queried by ICU DATA EXPERT for its Windows services, scheduled tasks, collectors, reports and monitoring processes

DATA LAYERS

From faithful copy to clinical views.

Three layers separate physical replication, a stable interface and clinical objects without multiplying data copies.

One-way physical replication to a protected read-only RAW database

RAW

Faithful physical copy

Replicated data remains read-only and close to its source.

INTERFACE

1:1 mirror views

Aliases and normalisation shield consumers from raw structures.

BUSINESS

Clinical views

Combinations, calculations and useful objects without further duplication.

DEFENCE IN DEPTH

Security does not depend on a single safeguard.

Encryption in transit, least privilege, a read-only replica, workload separation, service accounts and monitoring complement each other.

IN TRANSIT

Encrypted flow

The PROD → RAW connection is protected by TLS/SSL.

A queryable replica protected against all writes

INTEGRITY

Read-only

The replica does not become a second write source.

Separate, limited permissions for each component

ACCESS

Minimum permissions

Each component has only the privileges it needs.

Monitoring WAL replication lag between PROD and RAW

OPERATIONS

Monitored lag

Streaming status, lag, errors and recovery become observable.

Result

Analytical performance without putting clinical production at risk.

Clinical enhancements, heavy calculations and reporting can evolve in their own zone while the clinical system retains its operational priority.

CONTINUE

Explore the architecture in action.

Three paths to understand the engine, observe processing and adapt the topology to your environment.

Central engine orchestrating Windows services, scheduled tasks, collectors and reports

ENGINEView processesWindows services, scheduled tasks, collectors and reports.Explore the engine ↗02

Monitoring radar showing operational, warning and error states in real time

MONITORINGView the actual statusMake every process observable in real time.View monitoring ↗03

Analysis of a topology comprising PROD, RAW and ICU DATA EXPERT Engine zones

ASSESSMENTAnalyse your environmentAdapt the topology to your organisation.Request an assessment ↗