XyDromatics VNA Repository Router-pattern host · Retention tier

XyDromatics VNA Repository — where retired data lives.

The retention-tier archive. When a PACS or VNA reaches end-of-life — but its data has to live somewhere for compliance, retention windows, legal holds, or “we might need this someday” — VNA Repository is where it goes. Migration tools drain retiring systems into it; rare clinical lookbacks and audit retrievals read from it; nothing else routinely touches it.

Not your active clinical archive. That’s VNA Clinical. Repository is the cold tier underneath, and its Non-device software classification reflects exactly that — store-and-forward, no clinical interpretation in the active workflow.

Capabilities

An archive built for the long haul.

Pluggable storage. Pluggable catalog. Lifecycle-driven tiering. Hash-chain audit for regulated retention. The architecture choices below are what distinguish a VNA from a PACS archive you can’t move off of.

Migration-driven ingest

The primary write path: bulk migration of data from retired systems, not real-time clinical traffic.

  • Direct writes from XyDromatics Migration Engine (the typical writer)
  • Direct writes from XyDromatics VNA Migration (large-scale retirement engagements)
  • C-STORE SCP + STOW-RS endpoints supported, but not the steady-state pattern
  • Per-AE-Title access control restricts who can write — typically just the migration tool
  • Duplicate-study detection at SOP Instance UID level
  • Backpressure semantics during long migrations — sender sees clear throttling

Pluggable archive storage

Where the actual pixel data lives. A storage-provider abstraction backs the archive; the local-filesystem provider ships today, with additional backends on the roadmap.

  • Local filesystem — the shipping storage backend in v1.0 (point it at any mounted volume, including an NFS/SMB-mounted NAS path)
  • Storage-provider abstraction (IStorageProvider) lets future backends drop in without re-ingesting
  • S3-compatible object stores (AWS S3, MinIO, Wasabi, Backblaze B2, Ceph RGW, Cloudflare R2) — roadmap
  • Dedicated NAS providers (native NFS/SMB drivers) — roadmap
  • Encryption-at-rest follows the host volume today; per-backend encryption arrives with the additional providers

Pluggable catalog database

Where the metadata + indexes live. A catalog-store abstraction (IArchiveStore) backs the metadata; PostgreSQL is the shipping, supported driver in v1.0.

  • PostgreSQL (the supported catalog driver in v1.0, Npgsql) — others are gated off at startup until released
  • Catalog-store abstraction (IArchiveStore) — SQL Server and Oracle drivers are present in the codebase but not yet enabled/supported (roadmap)
  • No SQLite for production VNA — by Synthology standing rule for the VNA family
  • Schema-managed migrations with versioned upgrade scripts
  • PostgreSQL replication for HA today; SQL Server AG / Oracle RAC arrive with those drivers

Retrieval for occasional access

Reads happen rarely — compliance audits, legal-hold extraction, the occasional patient lookback. Standard interfaces, sized for low-rate access.

  • QIDO-RS (Query) — find studies / series / instances over HTTP
  • WADO-RS (Retrieve) — bulk retrieval as multipart/related
  • WADO-URI (legacy) — single-instance retrieval
  • Native DICOM C-FIND / C-MOVE / C-GET for SCU clients
  • No real-time arrival notifications (Repository isn't a live clinical feed)
  • Configurable response paging + cursor-based pagination

Retention & legal hold

Govern how long studies live and pin individual studies past their disposal date. This is the wired lifecycle surface in v1.0; automated multi-tier storage movement is on the roadmap.

  • Per-jurisdiction retention policies (state laws, country-specific windows)
  • Litigation / legal hold — pin specific studies past their retention end
  • Retention-end disposal recorded with a final hash-chain audit entry
  • Tag- and modality-aware policy rules (body part, study description, custom tags)
  • Multi-tier storage tiering (hot → warm → cold movement across backends, recall-on-demand) — roadmap, gated off in v1.0

Hash-chain audit & retention

Cryptographic integrity proof for every study from ingest through retention end.

  • SHA-256 hash chain over the write log — tamper-evident
  • 21 CFR Part 11-aligned audit trail (signature + timestamp + reason)
  • Per-jurisdiction retention policies (state laws, country-specific)
  • Litigation hold capability — pin specific studies past their retention end
  • Cryptographic receipt available for any study at any time
  • Independent integrity-sweep tool re-validates the entire chain

Operations & administration

The day-to-day surfaces operators use to run the archive.

  • Web administration UI with shared sidebar shell (consistent across XyDromatics)
  • Role-based access control with full permission catalog
  • Dashboard — ingest rate, archive utilization, retrieval latency
  • Structured JSON logs + standard health endpoints for load-balancer probes
  • Backup + independent integrity-sweep tooling included
  • Capacity-projection reporting and webhook event notifications — roadmap

Architecture

A retention tier, not a clinical archive.

Writers are migration tooling, not modalities. Readers are rare-access — compliance, legal hold, occasional clinical lookback — not routine diagnostic viewers. Storage backends and catalog DBs remain independently swappable substrates underneath.

XyDromatics VNA Repository architecture Migration tooling (Migration Engine, VNA Migration) drains retiring source systems — retired PACS, decommissioned VNAs, acquired-hospital archives — into the VNA Repository. Reads are rare: compliance audits, legal holds, and occasional clinical lookback. The repository's ingest engine, lifecycle engine, and hash-chain audit log sit over two independently swappable substrates: a catalog database and a storage backend. WRITERS · MIGRATION TOOLING READERS · RARE ACCESS Migration tooling Migration Engine · VNA Migration draining retired PACS / VNA / archives not modalities · not routine clinical traffic Rare-access readers Compliance · legal hold Clinical lookback (years later) not routine diagnostic viewers DICOM C-STORE STOW-RS (bulk migration writes) Q/R DICOMweb (rare retrievals) XyDromatics VNA Repository retention tier Ingest engine Lifecycle engine Hash-chain audit Catalog DB — PostgreSQL (v1.0) — SQL Server (roadmap) — Oracle (roadmap) PostgreSQL replication for HA Storage backend(s) — Local filesystem (v1.0) — S3 · R2 · MinIO (roadmap) — NFS · SMB drivers (roadmap) Retention + legal-hold policies

The catalog and the storage backend are independent — change one without touching the other. The same physical study can move across storage tiers over its lifetime while its catalog row stays put. The hash-chain log proves nothing in either layer was tampered with at any point in that journey.

For a typical retired-system retention engagement, the right-sized writer is the XyDromatics Migration Engine — a small-footprint standalone migration appliance. Reach for VNA Migration when the source archive is multi-PB or spans many vendor systems. The Router’s rule engine, MWL, and hold queue aren’t needed for retention writes; Migration Engine is purpose-built for this shape.

Common use cases

Five retention-archive patterns.

Every pattern below shares the same core shape: data has to live somewhere, but it isn’t the data your radiologists query daily. Production-clinical workflows belong on a different product (VNA Clinical, or your existing primary archive); Repository is the cold tier underneath.

Pattern 1

Retired PACS / VNA retention

The primary pattern. A legacy PACS or VNA reaches end-of-life. Its data has to live somewhere for the retention window — but the customer doesn't want to migrate it into their production clinical archive (different schema, different reading workflows, "we never touch this data anyway"). VNA Repository is where it goes.

Flow

  1. 1 Migration Engine drains the retiring PACS / VNA into Repository
  2. 2 Each study verified, hash-chain entry written
  3. 3 Retention policies govern each study's disposal date as it ages
  4. 4 Repository is queryable for the rare lookback, but not part of routine clinical workflow
  5. 5 Retention-end disposal happens per policy with a final hash-chain entry as proof
Pattern 2

Compliance / legal-hold archive

A separate retention tier for studies subject to specific regulatory windows (state laws, federal trials, malpractice litigation holds). Hash-chain audit becomes the retention proof. Often a customer's only Repository — a small archive holding only the regulated subset.

Flow

  1. 1 Source-side workflow tags studies for compliance retention
  2. 2 Migration Engine writes the tagged subset to Repository with hash-chain receipt
  3. 3 Lifecycle rules respect the longest-applicable retention window
  4. 4 Litigation hold pins individual studies past normal disposal
  5. 5 Audit export produces tamper-evident retention proof on demand
Pattern 3

M&A acquired-hospital archive consolidation

Health-system acquisitions inherit imaging archives the parent system doesn't want to fold into its production stack. Repository absorbs the acquired data so the acquired hospital's legacy environment can be retired without losing the historical record.

Flow

  1. 1 Pre-close: discovery against the acquired hospital's archives
  2. 2 Migration tooling drains the acquired system into the parent's VNA Repository
  3. 3 Per-source-hospital partitioning preserves the originating provenance
  4. 4 Acquired-hospital legacy systems retired post-migration
  5. 5 Future M&A waves layer additional source-hospital partitions over time
Pattern 4

Production-archive cold tier

A customer's active clinical archive (their VNA Clinical, or any production VNA) reaches a defined "cold age" for studies — say, anything older than 5 years that hasn't been touched in 18 months. Those studies tier down into Repository, freeing primary-tier capacity without losing the historical record.

Flow

  1. 1 Production VNA defines the cold-age policy
  2. 2 Lifecycle process migrates qualifying studies to Repository
  3. 3 Production VNA retains the catalog stub for query-ability
  4. 4 On the rare retrieval, production VNA queries Repository transparently
  5. 5 Repository's lower per-TB cost compensates for the indirection
Pattern 5

Multi-site retention with replication

Each site runs its own VNA Repository for its retired-data tier. Site-to-site replication keeps a copy where you need it today; a federated cross-site query layer is on the roadmap.

Flow

  1. 1 Site A and Site B each retain their own retired data in local Repository
  2. 2 Site-to-site replication mirrors a configured study set to a peer Repository (wired today)
  3. 3 Each Repository answers QIDO-RS / WADO-RS against its own catalog
  4. 4 Audit trail records retrievals with originating identity
  5. 5 A single federated query across all sites without centralizing data — roadmap

Integration points

What VNA Repository connects to.

Organized by interaction direction. A VNA spends most of its life listening to writers and answering readers; the integration surfaces below are how it does each.

Inbound (writers — migration tooling)

  • XyDromatics Migration Engine — the right-sized writer for typical retired-system retention
  • XyDromatics VNA Migration — for multi-petabyte retirement engagements
  • Third-party migration tooling (DataFirst, Laurel Bridge Compass, DicomSys UVR) — via IES-Advisors
  • Direct C-STORE / STOW-RS supported but rarely the steady-state pattern
  • Modalities and the Router do NOT typically write here in steady-state operation

Outbound (readers — rare access)

  • Compliance / audit teams retrieving for regulatory inquiry
  • Legal hold / e-discovery exports
  • Rare clinical lookback (patient returns after retention years)
  • Forensic / quality-review queries against historical data
  • AI / analytics platforms training against retired-data corpora
  • Production-VNA cold-archive retrieval — Repository queried directly via QIDO-RS / WADO-RS

Storage backends

  • Local filesystem — the shipping backend in v1.0 (any mounted volume, incl. an NFS/SMB-mounted NAS path)
  • S3 / S3-API object stores (AWS S3, MinIO, Wasabi, Backblaze B2, Ceph RGW, Cloudflare R2) — roadmap
  • Dedicated NAS providers (native NFS/SMB drivers) — roadmap

Catalog databases

  • PostgreSQL — the supported catalog driver in v1.0
  • PostgreSQL replication for HA
  • SQL Server / Oracle drivers present but gated off until released (roadmap)
  • No SQLite for VNA family (standing engineering rule)

Authentication & identity

  • Cookie-session admin auth with role-based access control
  • LDAP bind (license-gated) — works against Active Directory and other LDAP directories
  • AE-Title-based access control for DICOM associations
  • Per-AE-Title audit trail entries with configurable identity mapping
  • OIDC / SAML / Azure AD federation — roadmap

Monitoring & observability

  • Structured JSON logs (ELK / Splunk friendly)
  • Standard health endpoints for load-balancer probes
  • In-app SupportAgent telemetry to SynthGateway (system health, disk, queue, error tail)
  • Prometheus metrics endpoint + webhook event outputs — roadmap

System requirements & sizing

Sized to archive capacity.

Unlike Router (sized to study throughput), a VNA scales with archive capacity, ingest rate, and catalog size. Tiers below are starting points; final sizing comes out of discovery and accounts for retention windows + storage-backend choices.

Tier Archive capacity Ingest rate CPU RAM Catalog Typical site
Departmental < 50 TB < 100 GB / day 4 vCPU 16 GB PostgreSQL on the same host Imaging center, single-modality clinic, ambulatory site.
Hospital 50 TB – 500 TB 100 GB – 1 TB / day 8 vCPU 32 GB PostgreSQL HA pair (replication) Single hospital, full modality mix, 7-year retention.
Health-system 500 TB – 10 PB 1 TB – 10 TB / day 16 vCPU (ingest node) + 8 vCPU per DICOMweb node 64 GB per node PostgreSQL HA cluster Multi-hospital health system, large mounted-volume archive.
Enterprise > 10 PB > 10 TB / day 32 vCPU per node, 3+ nodes 128 GB per node Enterprise PostgreSQL, sharded if needed Large IDN, national reading network, multi-site replication.

Full hardware/software requirements are in DOC-2026-059 (HW/SW Requirements), available under NDA. Includes OS support matrix, supported databases (with version ranges), storage-backend matrix, and network requirements.

Licensing

Four packages, capacity-tiered.

Core is the base archive. DICOMweb adds modern retrieval interfaces, outbound forwarding, and replication. Lifecycle adds retention governance and legal hold (with pluggable storage backends and automated tiering on the roadmap). Enterprise unlocks 21 CFR Part 11 hash-chain audit, PostgreSQL HA, and unlimited capacity.

VNA Repository Core

The base archive — DICOM ingest, single storage backend, single catalog DB, classical Q/R.

  • C-STORE SCP / STOW-RS ingest
  • Local-filesystem storage backend
  • PostgreSQL catalog
  • DICOM C-FIND / C-MOVE / C-GET
  • Web admin UI + RBAC
  • Up to 100 TB archive capacity

VNA Repository + DICOMweb

Adds modern HTTP-based retrieval.

  • Everything in Core
  • QIDO-RS / WADO-RS / WADO-URI
  • Outbound C-STORE SCU + STOW-RS forwarding (multi-destination)
  • Site-to-site replication (peers + jobs)
  • Up to 1 PB archive capacity

VNA Repository + Lifecycle

Adds retention governance + legal hold. (Pluggable storage backends and automated multi-tier movement are on the roadmap.)

  • Everything in Core + DICOMweb
  • Per-jurisdiction retention policies (time / modality / tag-aware)
  • Litigation / legal hold
  • Hash-chain + integrity-sweep audit over the archive
  • S3 / NAS storage backends + automated hot/warm/cold tiering — roadmap
  • Up to 5 PB archive capacity

VNA Repository Enterprise

Everything, plus enterprise scale and HA.

  • Everything in Core + DICOMweb + Lifecycle
  • 21 CFR Part 11-aligned hash-chain audit log
  • PostgreSQL HA (replication)
  • Litigation-hold capability
  • Unlimited archive capacity
  • Premium support tier eligible
  • Multi-site federation query layer + SQL Server / Oracle catalog drivers — roadmap

Licensing is per-deployment, capacity-tiered. Storage costs are separate (you bring the storage backend). Multi-product bundles (VNA Repository + Router + Migration Engine) get product-bundle pricing; multi-site customers get site-discounted bundles. Specific pricing in your engagement SOW.

Documentation

The controlled-document set.

Every VNA Repository deployment ships with the documents below, all managed under SynthQMS document control. The DICOM Conformance Statement is publicly available; the rest are shared under mutual NDA.

Document Title Notes
DOC-2026-128 Hardware & Software Requirements (VNA Repository) Sizing, OS support, dependencies
DOC-2026-138 DICOM Conformance Statement (VNA Repository) Public — full SOP class + transfer-syntax matrix
DOC-2026-133 EULA Annex (VNA Repository) Annex to the Synthology Master EULA (DOC-2026-063)
DOC-2026-148 Penetration Test Results (VNA Repository) Available under NDA
DOC-2026-143 QA Runner Manual (VNA Repository) Internal QA + customer-validated test runs
DOC-2026-159 User Guide (VNA Repository) Operator + administrator workflows
DOC-2026-164 Installation Guide (VNA Repository) Includes MSI deploy + Linux tarball install

Frequently asked

The questions prospects ask.

Can I use VNA Repository as my primary clinical archive?

No. Repository is the retention tier — designed for data that has to live somewhere but isn't actively queried in clinical workflow. Your primary clinical archive should be VNA Clinical or your existing production VNA. Repository sits underneath whichever primary archive you run, holding retired data that ages out of the production tier.

What writes to VNA Repository?

Migration tooling, almost exclusively. The typical writer is the XyDromatics Migration Engine — a small-footprint standalone migration appliance that's the right size for draining a retired PACS or VNA into Repository. For multi-PB or multi-vendor consolidation engagements, VNA Migration is the heavyweight option. Modalities and the Router don't typically write to Repository in steady-state operation — they write to the production clinical archive. Repository receives data when it ages off the primary tier or when a retiring system gets drained into it.

How is VNA Repository different from VNA Clinical?

Different role in the imaging stack. VNA Repository is the retention tier where retired or aged-off data lives — store-and-forward, no clinical interpretation. VNA Clinical is the active clinical archive where radiologists query and report. Both are non-device software under FD&C Act §520(o)(1)(D). The non-device classification fits Repository precisely because it's store-and-forward without clinical interpretation in the active workflow. They ship as separate executables on separate ports — same code base, same libraries, but a product boundary that's also a code boundary.

Why not SQLite for the catalog?

Standing engineering rule across the VNA family: the production VNA catalog targets enterprise RDBMSs over real ADO.NET drivers (PostgreSQL ships today; SQL Server and Oracle drivers are on the roadmap). SQLite is fine for engines that don't back a regulated archive (Router can use SQLite for small deployments), but a VNA catalog routinely holds millions of studies and tens of millions of catalog rows where SQLite's concurrency model breaks down. The rule is in our memory file as a permanent decision.

Can we change storage backend after we've started ingesting?

The catalog references studies by logical key, not by physical path, so the architecture is built to swap storage providers without re-ingesting. In v1.0 the shipping provider is the local filesystem (point it at any mounted volume, including an NFS/SMB-mounted NAS path); additional providers (S3-compatible object stores, dedicated NAS drivers) and the online storage-migration tool are on the roadmap.

Does Repository do automated hot/warm/cold storage tiering?

Not in v1.0. Today Repository governs data lifecycle through retention policies and legal holds (with hash-chain audit of disposal), on a single storage backend. Automated multi-tier movement across backends — e.g. cold studies aging onto S3 Glacier-class storage with recall-on-demand — is on the roadmap and is gated off in the shipping build.

How does the hash-chain audit work?

Every write to the archive creates a chain entry: SHA-256 of (study identifier + ingest timestamp + previous chain hash + study content hash). Tampering with any single entry breaks the chain at that point and is detectable by re-running the integrity-sweep tool. The chain root is the hash auditor will verify; we publish the most recent chain root in the regulated audit log so a tamper at any earlier point is provable.

Is VNA Repository cross-platform?

Yes — Windows and Linux. The MSI installer covers Windows; a self-contained Linux tarball covers Linux. Both are supported equally; HA pairs can mix OS platforms.

How is data deleted at retention end?

Lifecycle rules can be configured to either move studies to a disposal-pending state for human review, or trigger automatic deletion. Automatic deletion records a final hash-chain entry that proves the disposal happened — auditable retention proof is part of the deal. Litigation hold can pin individual studies past their retention end indefinitely; the holds are themselves audited and require approver sign-off.

What's the regulatory classification?

Non-device software under FD&C Act §520(o)(1)(D), the 21st Century Cures Act §3060 carve-out for software that transfers, stores, converts, or displays device data without interpreting or analyzing it. No FDA Device Listing required; no premarket review applicable. Same framework as every other Synthology product. See /regulatory for the full posture.

Talk through your archive needs.

Tell us your environment — current archive, retention windows, storage standard — and we’ll come back within one business day with a proposed architecture and a 30-minute walkthrough with the right engineer on our side.