The jurisdiction
The data never leaves the hospital.
LUMEN runs entirely inside the hospital, on hardware the hospital owns, in the hospital's own jurisdiction. The model, the record, the keys, and the audit chain live in the building. Nothing in the path of care crosses a border.
Outbound transfer manifest
The wall ledger
One side holds everything. The other holds nothing.
Stays inside the hospital
- The modelThe hospital's own asset, running in its own machine room, adapted to its own guidelines on its own infrastructure.
- The patient recordOn hospital-owned hardware, under hospital-held keys, in the hospital's legal jurisdiction.
- The keysHardware-bound and hospital-held. No vendor, including us, holds the keys to the hospital's brain.
- The audit chainAppend-only and portable, so the hospital can prove what happened, to a regulator or to a family, without asking a vendor.
- Every clone sessionEach clinician's clone reasons on the Core, inside the building, on the hospital's private fabric.
Crosses the border
Nothing.
No patient record, no model, no key, and no audit entry leaves the building. There is no foreign processor in the path of a patient record, by architecture, not by policy: the system has no such dependency to configure away.
Cut the uplink and nothing in the path of care stops, because nothing in the path of care was on the other side of it. The first reference site is where that property will be shown running.
The law of the land
The strictest reading of the strictest law is the easy case.
Data-residency law regulates what crosses the border. An architecture that moves nothing across it turns the hardest chapter of a compliance review into the shortest one.
Saudi Arabia's Personal Data Protection Law places a transfer-approval and safeguards burden on any architecture that moves personal data abroad. An architecture that keeps the record inside the hospital never triggers the question. Verified against a global law firm's data-protection handbook, and presented as a legal-landscape reading, not as legal advice.
The architecture is mapped against these frameworks, and mapped means mapped: certification is pursued per deployment, and we claim no certificate we do not hold.
The structure
The company is shaped like the data.
Three layers, each keeping what belongs to it: the IP lives in Canada, the Kingdom's work lives in the Kingdom, and the record never leaves the hospital.
The Canadian company
LUMEN, a PulsarOS Intelligence company. Holds the technology and the intellectual property, worldwide, under Canadian law.
The Saudi subsidiary
The Kingdom's engineering node: deployment, Arabic clinical language work, integration with the Kingdom's health platforms, clinical validation, and Saudi hires, serving the Kingdom's healthcare transformation.
The hospital
Owns the hardware, the model it runs, the record, the keys, and the audit chain. If the vendor disappeared tomorrow, the hospital keeps all five.
Measured, with its qualifiers
Why frontier models fit inside a hospital.
Hospital-owned inference is only sovereign if frontier-scale models fit hospital-owned machines. Compression is how they fit. One result is measured today, published with its qualifiers, and its two tiers are kept separate.
measured compression on the lossy INT2 tier of a real 31-billion-parameter model, 58.25 GB to 5.92 GB, on reference hardware, not on the target edge silicon. This figure belongs to the lossy tier only and is never attached to the word lossless.
tensors bit-identical in the separate lossless pass on the same model, verified tensor by tensor. Lossless means exactly that, and it carries no compression ratio from the lossy tier.
Sovereignty is the product, not a feature.
One boundary holds everything: the hospital keeps the keys, the model, the record, and the audit. That is the whole thesis, and every page of this site is downstream of it.