This page describes the controls that exist in the product today. We don't claim compliance with FDA, GxP, ISO, or similar frameworks — whether those matter to your lab is a question for your own quality processes.
Organization-level data separation
Each lab is an organization. Every record — inventory, samples, equipment, SOPs, projects — belongs to an organization, and every query in the application is scoped to the active organization. A member of one lab cannot read or write another lab's records, and records carry no cross-organization references.
Authentication
Accounts use standard Django authentication with hashed passwords. New accounts require email verification before activation. Sessions are HTTPOnly cookies with a SameSite policy, and production deployments run behind HTTPS with HSTS. Registration includes protections against account-enumeration.
Role-based permissions
Within an organization, roles range from owner and admin through lab manager, scientist, and technician to viewer. Permissions are enforced server-side on every mutation endpoint — creating, editing, and deleting are checked per domain, so a client that doesn't respect the rules still can't exceed them. Viewers get read-only access.
Audit trail
Changes to records are written to an audit trail with the actor, the organization, a timestamp, and what changed. Security-relevant organization events — membership changes, role changes — are recorded as well, and the audit log is browsable in the app.
File uploads
Uploaded files (e.g. calibration certificates) are validated for type and size, served with
Content-Disposition: attachment so documents download rather than execute in your
browser, and are only reachable to signed-in users.
Data integrity and backups
The deployment setup includes scheduled database backups with retention pruning, and a documented restore drill. Production settings enforce TLS-related headers (HSTS, content-type nosniff, frame denial) and a conservative Content-Security-Policy. Backups are documented in the deployment guide shipped with the product.
Your data is yours
Your data is exportable: inventory exports to CSV, and the REST API gives programmatic access to your records. Deleting your organization removes its data.
Reporting an issue
If you find a security problem, email contact@scientivolab.com and we'll take it seriously and respond as quickly as we can.