Shared responsibility

• Solia: platform isolation, authorization enforcement, credential storage, delivery and audit records, fail-closed connection gates and the release decision for native connectors.
• Laboratory: catalog accuracy, mappings, clinical release decisions, member access, and validation of its own interfaces. The laboratory remains responsible for each transaction and its clinical content.
• Laboratory IT: network path and firewall rules, LIS interface configuration and licences, test endpoints and credentials, and hosting of any gateway or Edge agent inside its network.
• Partner: protecting its API keys, verifying webhook signatures, deduplicating deliveries, and handling data lawfully in its own systems.

Platform-wide availability and incidents are published on System Status. Integration issues are raised through Contact Solia with identifiers only.

• A partner registers subjects using its own opaque identifier. Names, dates of birth and clinical detail are not part of that reference.
• Events and webhook deliveries carry allow-listed identifiers and coarse state only — never analyte values, demographics or report documents.
• Report documents are retrieved per request through the governed report endpoint; no permanent or signed document URL is issued.
• Released results are the only results exposed externally; an unreleased version is reported as pending or not found regardless of its internal state.