Platform
Architecture
One principle governs the whole system: deterministic NLP establishes what documents say; LLMs reason only over verified evidence. Everything else follows.
Business view — the pipeline
- 1
Ingestion & classification
16 formats normalized into one canonical view; rule-based classifier assigns document type.
- 2
Privacy boundary
Fail-closed de-identification before anything downstream executes.
- 3
Clinical understanding
Deterministic NLP: entities, assertions, temporality, coreference, relations.
- 4
Terminology linking
Mentions map to SNOMED CT, RxNorm, LOINC, ICD, HPO, MedDRA, HGVS concepts.
- 5
Biomedical IR
Every fact lands in one canonical contract — provenance-stamped, assertion-qualified, time-anchored.
- 6
Derived structures
Timeline builder, provenance-carrying evidence graph, hybrid retrieval index.
- 7
Evidence packs
Retrieval assembles cited evidence neighborhoods for each question.
- 8
Reasoning firewall
Claims validated against evidence (token overlap + numeric fidelity); unsupported statements dropped.
- 9
Audited intelligence API
Answers ship with citations, claim verdicts, uncertainty notes — and usage meters fire exactly once.
Explore each stage interactively in the intelligence pipeline explorer.
Technical view — AWS deployment
Compute
Amazon EKS · separate node groups for API pods, CPU-bound NLP workers, GPU inference pool (vLLM serving local Qwen/Llama/Mistral models).
Relational & graph data
Aurora PostgreSQL with Apache AGE for the evidence graph (openCypher internally — never exposed publicly).
Search
Amazon OpenSearch for production-scale hybrid retrieval (BM25 + vector-capable indexes).
Object storage
S3 with SSE-KMS encryption, versioning, and lifecycle policies mapping logical storage classes.
Async & events
Amazon MSK / EventBridge carry immutable usage events and job orchestration between services.
Secrets & keys
AWS KMS customer-managed keys; Secrets Manager holds privacy secrets, provider keys never present in application code.
Edge
Route 53 → WAF → ALB → private pods. No public IPs inside the cluster; EKS endpoint private.