Platform & security
Your server. Your data. Running even when the internet isn’t.
DicoFlow LRIMS is one application — a FastAPI backend and a React frontend — installed on a Windows PC in your centre and used from every workstation through a browser. Security, audit and recovery are built into the core, not bolted on.
Equipment
Imaging modalities
CT · MR · CR/DX · USG · MG — DICOM C-STORE + Worklist
Lab analyzers
ASTM · HL7 v2 · RS-232 · TCP · file / FTP
Hospital systems
HL7 v2 (MLLP) · FHIR R4 — when enabled
DicoFlow server
Your Windows PC · on your premises
Keeps working when the internet is down
Every PC in the centre
Front desk & billing
Chrome · Edge · Firefox
Lab benches & pathologists
Role boards, verification, sign-off
Technicians & radiologists
Boards, viewer, report editor
Admin & management
TAT, revenue, audit, backups
Deployment
Installs like a desktop program. Runs like a server.
A signed Windows installer sets up the application, opens the DICOM and web ports, and registers an auto-start service with a watchdog. A pre-install check tool tells you whether a PC is ready before you begin.
- Works fully offline on your LAN
- Unlimited users — every PC in the building
- Modules activate by licence, without a restart
- Recovery launcher installed alongside
- Uninstalling deliberately keeps your patient database
Server requirements
- Operating system
- Windows 10 / 11 (64-bit) or Windows Server 2016+
- Memory
- 8 GB minimum · 16 GB recommended
- Storage
- SSD strongly recommended · 200 GB+ free (50 GB minimum)
- Processor
- 4 or more logical threads
- Workstations
- Any PC on the LAN with Chrome, Edge or Firefox
- Recommended
- Dedicated server PC, UPS, static IP or DHCP reservation
Access control
The right screen for every role — and nothing more
26 user roles and 158 permissions, with 17 ready-made permission presets. Every user lands on their own workspace after sign-in.
Authentication
Signed session tokens — sign in first, or nothing loads
Permission
158 fine-grained permissions, per-user grants and explicit denies
Licensed module
Unlicensed modules are invisible and refused by the server
Edition
Screens that do not belong to your edition never appear
Page visibility
Admins decide which pages each role sees
Server-side gate
Every API call is checked again — the browser is never trusted
All six must pass. A failure at any layer stops the request.
Administration
Front office
Radiology
Laboratory
Plus clinical-discipline roles. Report dispatchers can be scoped to lab, radiology or both.
Sign-in & data protection
Defence in depth, configured out of the box
Two-factor authentication
TOTP 2FA with 10 single-use recovery codes. Administrators can require 2FA for any user.
Modern password security
Argon2id hashing, password history and expiry rules, and lockout after 5 failed attempts.
Idle auto-logout
Unattended sessions close automatically — configurable from 1 to 480 minutes, 15 by default.
Audited break-glass access
Time-limited emergency access for urgent situations, fully recorded in the audit trail.
Encryption at rest
AES-256-GCM envelope encryption for identifiers such as Aadhaar, report text, lab results and DICOM files — with key rotation.
PHI-aware screens
Patient banners on every clinical screen, PHI highlighting in the DICOM tag browser and a presenter mode that masks identifiers.
Audit log
Chain verifiedTamper-evident audit
An audit trail that proves it hasn’t been edited
Every entry is linked to the one before it with a SHA-512 hash chain, and checkpoints are signed with Ed25519. Verification is one click from the System Dashboard.
- Before-and-after values on every change
- Filters by user, action and date, with CSV export
- Print, dispatch and share events recorded
- Every PC-PNDT block and break-glass session logged
Backups you can actually restore
Schedule backups hourly, every six hours, daily or weekly, and keep anywhere from 1 to 90 of them — with or without DICOM images.
- AES-256-GCM encrypted recovery bundles: database, files and keys
- Verify any backup before you need it
- Preview before restoring onto a fresh installation
- A verified restore drill is part of go-live
Updates on your terms
Updates arrive as signed packages and are applied from the in-app Update Center — never automatically, and never during working hours.
- Signature and checksum verified before anything changes
- Preview what an update contains, then arm it
- Automatic rollback if the post-start health check fails
- Cumulative packages — ideal for sites without internet
Interoperability
Standards-based, end to end
DicoFlow speaks the protocols your equipment and partners already use.
DICOM
C-STORE SCP with multiple listeners and AE whitelisting, Modality Worklist SCP, C-STORE forwarding, DICOM SR on report verification, optional TLS 1.2+
ImagingASTM E1394 · HL7 v2
Lab analyzers over TCP, RS-232 serial, folder watch or FTP/FTPS, with bidirectional worklists and host query
LaboratoryHL7 v2 (MLLP)
Inbound ADT and orders, outbound ORU results on sign-off — enabled during set-up
Hospital systemsFHIR R4
Read and search for Patient, ImagingStudy, DiagnosticReport, Observation and ServiceRequest
Hospital systemsMessaging
WhatsApp (Meta Cloud API, Twilio), SMS (MSG91 with DLT, Twilio, Amazon SNS), email (SMTP, Amazon SES, SendGrid) — through your own accounts
DeliveryData export
Vendor-neutral DICOM export with manifest; ODBC/JDBC connection strings and schema for reporting tools
OwnershipUsability
Designed for the people at the counter and the bench
10 UI languages
English, Hindi, Odia, Bengali, Tamil, Telugu, Kannada, Malayalam, Marathi and Gujarati.
Role-based workspaces
Each role lands on its own board, worklist or dashboard after sign-in.
Live boards
Boards and dashboards update live over WebSockets and server-sent events.
Automatic work routing
Services map to staff by role or user, with round-robin or least-loaded balancing.
Engineering quality
Tested like clinical software should be
An automated backend suite covers the specimen lifecycle, turnaround clocks, verification chains, billing edge cases, DICOM receive and PC-PNDT — plus a security matrix of every role against every endpoint.
- Automated backend tests
- 2,100+
- Release gates passed
- 14/14
- Licence attacks rejected
- 9/9
- Crashed pages
- 0
Across 160 test files
Pre-release verification of the compiled program
Tampering, reuse, hardware move, clock rollback
Across 467 automated page tours
Attack suites
Authentication, injection, data protection and transport tests
Simulated centre
1,132 synthetic patients run end-to-end by automated agents
Crash recovery
Power-cut and crash scenarios tested for clean recovery at boot
Licensing
A licence that protects you, too
Your licence is cryptographically signed and locked to your server hardware. Activation takes three steps and works without an internet connection.
Download the hardware ID from the activation screen
Send it to Techmasys
Upload the signed licence file — modules switch on immediately
FAQ
Platform questions
Walk through the platform with an engineer
We will show you installation, backups, audit verification and access control on a live system — and answer your IT team’s questions.