DICOM files delivered.
Then destroyed.

Send MRI, CT, and X-ray files via post-quantum encrypted relay. Client-side encryption, burn-on-read, Merkle audit trail. Zero persistent storage. EU only.

The problem with DICOM transport

DICOM files carry the most sensitive patient data there is: images, metadata with BSN, birth date, diagnosis codes, referring physician. Every transfer is a compliance event.

Architecture

All encryption happens on the client. The relay sees only opaque ciphertext. The file is destroyed after the first authorised download.

Step-by-step setup

1. 1

   Install the paramant client

   Runs on any Debian/Ubuntu system, including Raspberry Pi and embedded Linux. No Python environment needed — the .deb bundles everything.

   # Debian / Ubuntu (amd64 or arm64)
   curl -fsSL https://paramant.app/install-client.sh | bash
   
   # Or manual .deb install
   wget https://github.com/Apolloccrypt/paramant-relay/releases/latest/download/paramant-client_amd64.deb
   sudo dpkg -i paramant-client_amd64.deb
   
   # Verify
   paramant-sender.py --version
   # paramant-client 2.4.5

2. 2

   Configure

   Request a pgp_ API key at privacy@paramant.app. Keys for healthcare are issued against the health.paramant.app sector.

   # Interactive setup
   paramant-setup
   # Relay:  health.paramant.app
   # Key:    pgp_xxxxxxxxxxxxxxxx
   # Device: mri-001
   
   # Or write config directly
   mkdir -p ~/.paramant
   cat > ~/.paramant/config.json <<EOF
   {
     "relay":  "https://health.paramant.app",
     "key":    "pgp_xxxxxxxxxxxxxxxx",
     "device": "mri-001",
     "sector": "health"
   }
   EOF

3. 3

   Send a DICOM file

   Files are encrypted before leaving the machine. The relay only sees ciphertext.

   # Single file
   paramant-sender.py --key pgp_xxx --device mri-001 --sector health scan.dcm
   # → Uploaded: https://health.paramant.app/v2/blob/abc123
   # → CT leaf:  3fa7b2c4d8e1...
   # → Expires:  burn-on-read (no TTL)
   
   # Watch folder — auto-send new DICOM files as they appear
   paramant-sender.py \
     --watch /dicom/outbox/ \
     --device mri-001 \
     --sector health \
     --key pgp_xxx

   Persistent watch with systemd

   # /etc/systemd/system/paramant-dicom.service
   [Unit]
   Description=Paramant DICOM sender
   After=network.target
   
   [Service]
   ExecStart=/usr/local/bin/paramant-sender.py \
     --watch /dicom/outbox/ \
     --device mri-001 \
     --sector health \
     --key pgp_xxx
   Restart=always
   RestartSec=10
   User=paramant
   
   [Install]
   WantedBy=multi-user.target

   sudo systemctl enable --now paramant-dicom

4. 4

   Receive and forward to PACS

   The receiver polls the relay, decrypts locally, and forwards the raw DICOM bytes to your PACS.

   # STOW-RS compatible endpoint
   paramant-receiver.py \
     --key pgp_xxx \
     --sector health \
     --forward http://pacs.hospital.nl:11112/api/dicom
   
   # DICOM DIMSE (C-STORE SCU)
   paramant-receiver.py \
     --key pgp_xxx \
     --sector health \
     --forward-dcm pacs.hospital.nl:11112 \
     --forward-aet DESTINATION_AET

5. 5

   Verify delivery in the CT log

   Every transfer creates a Merkle leaf hash. The log proves delivery at a specific timestamp without storing any patient data.

   curl https://health.paramant.app/v2/ct/log?limit=5 \
     -H "X-Api-Key: pgp_xxx" \
     | python3 -m json.tool

   # Example response
   {
     "ok": true,
     "root": "3fa7b2c4...",
     "entries": [
       {
         "index": 47,
         "leaf_hash": "3fa7b2c4d8e1...",
         "tree_hash": "9b4c1a2e...",
         "device_hash": "a1b2c3...",
         "ts": 1744649123
       }
     ]
   }

Compliance summary

How Paramant maps to the NEN 7510 and GDPR requirements for DICOM transport.

FAQ