An HDS-compliant software factory for a health research organisation

The challenge

A public health research organisation is industrialising its digital projects. It needs a secure software factory to build, test and deploy applications that handle health data, compliant with French health data hosting rules (HDS), the GDPR and the national digital health agency’s frameworks, with many parties involved: vendors, internal teams, partners.

• Sensitive health and clinical research data; auditability, traceability and isolation requirements.
• Full traceability, from code to deployment and operations.
• Software supply chain risks to reduce.

What we did

Governance and compliance

• Project management.
• Definition and implementation of HDS technical controls; GDPR compliance (minimisation, traceability, logging).
• Preparation for HDS audits: evidence, documentation, traceability.

Architecture and DevSecOps

• Secure continuous integration and delivery pipelines, with automated security testing (SAST, DAST, container image scanning) and dependency control.
• Isolation of development, test and production environments; network segmentation following Zero Trust principles.
• Identity and access management (RBAC), secrets management, security rules as code.
• Centralised logging, monitoring and alerting.
• Support for project teams adopting DevSecOps practices.

What changed

• A platform that meets HDS requirements and can be audited.
• Faster deployments, without lowering the level of security.
• Sharply reduced software supply chain risks, and better traceability of access and data.