Mission-scoped access, audited
Security & Privacy
Astronaut health data is among the most sensitive information on a mission. Access is decided by mission membership and role in the database itself, every sensitive action is audited, and research receives de-identified data only.
Why it matters for long-duration spaceflight
- Small crews make individuals easy to identify, so privacy must be designed in.
- Medical oversight, research and operations need different, separated access.
- Security failures must fail closed and never be turned into medical conclusions.
How The Mitochondria addresses it
- Forced row-level security with mission-scoped roles: Crew Self, Ground Medical, Researcher and Mission Operator.
- Authenticated database functions with internal authorization checks and append-only audit events.
- Pseudonymized research export with restricted keys.
- Encrypted local storage on the astronaut device.
Architecture diagram
- 01Authenticated user
- 02Mission membership & role
- 03Row-level security
- 04Audited, scoped data
Technical explanation
Role separation
Identified medical oversight and de-identified research are separate roles. Mission Operators see operational totals rather than medical detail.
Threat model
The connected path is threat-modeled from sensor collection through local storage, synchronization, ground access and research export.
Implementation status and limitations
- Implemented in repository
Row-level security, mission-scoped roles, audit events and pseudonymized export are implemented in production.
- Implemented in repository
FV-01.4.3 multi-role hardening (role compatibility, self-acceptance blocks, Ground Medical recipient binding and independent approval) is applied in production as governed migration 12.
- Partially implemented
An open platform-level finding (FV-01-13) keeps the overall final security gate blocked.
Known limitations
- No independent penetration test has been completed.
- The platform does not yet offer multi-factor or directory-backed identity assurance.
The Mitochondria is human decision support. It does not diagnose, prescribe treatment or replace qualified medical judgment.