The operational core for connected hospital care.

Enforced on the server

• Every module is dark until a facility is entitled to it. The master switch and each module flag are set by Vantra, and they are stripped out of the hospital's own settings save - a manager cannot grant a module to themselves.
• A visible button is not permission. Every request re-checks the facility boundary, the module entitlement and the capability before it reads or writes anything. Hiding a workstation in the browser is a convenience, never the control.
• Administrative authority is not clinical authority. Managers, owners and platform administrators do not dispense or prescribe by rank; that takes a clinical credential recorded against the member.
• Separation of duty is in the matrix, not the manual. A storekeeper receives stock but never dispenses it, a pharmacist dispenses but never receives, and only a manager or above approves a purchase order.

What it does not claim

• It is operational billing, not a general ledger. It produces charges, invoices, payments, receivables, day-books, reconciliation and a mapped export - multi-line general-ledger posting stays with the hospital's accounting system.
• It does not hold images. Radiology keeps orders, study metadata and reports; Vantra never uploads, proxies or archives DICOM pixels, and the viewer that opens from the worklist is an external one deployed per facility.
• A finalised invoice hands a durable, SHA-ready claim contract to the Integration Hub. That is not proof that a claim was submitted, accepted or paid, and the product does not present it as one.
• Offline is a bounded allowlist, not a disconnected hospital. Bed allocation, transfer, discharge, controlled medication and every patient-state change stay online-only, because replaying them without a fresh concurrency check is unsafe.