Your Data Is Safe With Us
AI Lab Services is built for regulated industries that cannot afford data breaches, compliance gaps, or unauthorized access. Security is not a feature — it is the foundation.
Application-Level
Encryption
SHA-256
COA/Report Integrity Hash
Tenant-Scoped
Every Query Isolated
5-Year
Audit Log Retention
Once issued, a COA/Report cannot be edited or re-issued
by anyone — including platform administrators.
The lock is enforced at the data layer, not by policy. There is no admin override, no back-door edit endpoint, and no soft-delete. Every issued COA/Report carries a SHA-256 integrity hash verified on every download — if a single byte changes, the check fails. Auditors can verify this independently.
SHA-256 integrity hash
Computed at issue time, re-verified on every PDF download.
No re-issue, no edit
Issued COAs/Reports are write-locked at the database level. Status can only move to corrected — never overwritten.
Full audit chain
Every view, download, and verification attempt is logged with user, IP, and timestamp — including platform staff.
Ten Layers of Protection
Built from the ground up for operations that work under accreditation, regulatory oversight, or enterprise procurement requirements.
Tenant-Scoped Data Isolation
Every query is checked against your tenant ID
- Every query is scoped to the tenant ID from the authenticated session
- A 22-test isolation suite attempts cross-tenant reads on every release
- Bring-your-own database and EU hosting give a tenant a dedicated database if it needs its data held separately
- Your data stays yours — we cannot access it without your explicit authorization
Encryption, Scoped Accurately
Application-level encryption for secrets, TLS in transit
- Connection strings, tokens, API keys, and two-factor secrets encrypted at the application level
- TLS encryption for all data in transit — no unencrypted communication
- Storage-level encryption at rest is provided by the hosting provider
- A SHA-256 integrity hash detects tampering on every issued COA/Report, independent of storage encryption
Role-Based Access Control
The right people see the right things
- Four role tiers: Admin, Manager, Technician, and Read-Only
- Every action in the platform requires the appropriate role — enforced at the API level
- Module-level licensing gates access to COC, COA/Report, QMS, Equipment, and API features
- Client portal runs on a separate authentication track with its own credentials
Tamper-Evident Audit Trail
5-year tamper-evident log of every action
- Every login, data change, approval, and export is permanently logged
- Logs capture: user, IP address, timestamp, action, and affected record
- Suspicious activity detection flags critical events automatically
- PDF audit export available for inspections and regulatory submissions
- Retained automatically for 5 years — no manual archiving required
Secure Authentication & MFA
Multiple layers to stop unauthorized access
- TOTP-based two-factor authentication — works with Google Authenticator, Authy, and any standard authenticator app
- Admin-configurable 2FA policy — enforce MFA for all users or admin accounts only from the Security settings
- Single-use backup codes for 2FA recovery — emergency access when your device is unavailable
- Admin 2FA reset — account admins can unlock a team member's 2FA, fully logged to the audit trail
- Short-lived access tokens that automatically expire — limiting exposure if compromised
- Rotating refresh tokens — each session renewal invalidates the previous token
- All passwords hashed with an industry-standard algorithm — never stored in plain text
- Password complexity enforced — uppercase, lowercase, number, and special character required
- Configurable password expiry — flagged in the 21 CFR readiness assessment
- Account lockout after repeated failed attempts — timed lock with critical audit event
- Re-authentication required before signing critical records (COA/Report issue, SOP sign-off, COC acceptance)
- Idle session timeout — automatic logout with on-screen notice
- Cryptographic hash on every issued COA/Report — tamper detection via integrity check endpoint
- Issued COAs/Reports are write-locked at the database level — no edit or re-issue is possible by any user, including platform administrators
- Password change and reset immediately revoke all active sessions
- Generic error responses prevent account enumeration attacks
Data Sovereignty & Retention
Your data, your rules
- You own your data — it is never used for training, analytics, or shared with third parties
- Configurable retention periods to match your accreditation requirements (default 7 years)
- Full data export available at any time in standard formats
- On cancellation, your data is retained for 30 days then securely deleted on request
Built-in Legal Agreements & E-Signature
Vendor compliance handled on day one
- Data Processing Agreement (DPA) signed electronically during account setup — no back-and-forth required
- HIPAA Business Associate Agreement (BAA) available for clinical operations handling patient data
- Every signature is recorded with signer name, title, IP address, and timestamp for your audit records
- Signed agreements are permanently stored in your account — viewable and printable at any time
- SaaS Agreement and Service Level Agreement available for enterprise procurement requirements
Continuous Platform Verification
Every module tested end-to-end, automatically
- End-to-end health checks run across every platform module — COC, COA/Report, QMS, 2FA, equipment, integrations, and more
- Cryptographic COA/Report integrity is re-verified automatically on every run to catch tampering or regression
- Health score is mathematically honest — any test failure prevents a clean score, full stop
- Tests run in isolated environments using ephemeral tenants — your live data is never touched
- Pass/fail results and the health score are reviewed by the platform team before any release
Adversarial Security Testing
Not just "does it work" — "can it be broken"
- Dedicated adversarial test suite runs injection attempts, SSRF probes, and privilege-escalation attacks against the live API
- Injection payloads, XSS, and oversized inputs are sent to every major endpoint and verified to be rejected safely
- SSRF protection is tested by pointing integration connectors at disallowed destinations — all must be blocked
- Separation of duties is verified: SOP authors cannot sign as their own reviewer or approver
- Race condition tests confirm one-time codes cannot be double-redeemed via concurrent requests
- Mass assignment tests verify that protected fields cannot be overwritten via unexpected input
- These tests run alongside functional tests every release — security regressions are caught before they ship
EU AI Act Compliance
Articles 9–17 mapped to AILS controls — automated gap assessment included
- Automated EU AI Act compliance assessment maps 9 articles to AILS platform controls
- Article 9 (Risk Management): Risk Register and CAPA module provide documented lifecycle risk management
- Article 14 (Human Oversight): Re-authentication on COA/Report signing, manager override with re-auth, and RBAC-enforced issuance gate
- Article 15 (Cybersecurity): application-level encryption, multi-factor authentication, and 1232 automated tests including adversarial scenarios
- Article 17 (QMS): Full quality management system covers CAPA, audits, deviations, training, risk, and proficiency testing
- Article 27 (FRIA): Fundamental Rights Impact Assessment lifecycle — draft, re-authenticated approval, locked publication, regulator-ready PDF
- Article 50 (Transparency): every AI-drafted narrative that reaches an issued document, a portal client, or a report carries a disclosure, logged with its recipient type — a governance record, not just an on-page notice
- EU tenants can run an automated compliance assessment and download a regulator-ready PDF report from their dashboard
Trust Loop
A continuous posture check against your live records, not an annual snapshot
- A standing scan across six categories of your live records, queried on demand — not a document review performed once a year
- Each category returns a count, a status, and a specific finding, rolling up to one overall status: green, amber, or red
- Names the single next action that would move the status, rather than leaving you to infer what a score actually means
- A scannedAt timestamp on every result, so a stale check reads as stale rather than as quiet reassurance
Compliance Architecture Flows
How AI governance, CAPA, training enforcement, and the audit trail are each implemented as a platform control rather than a configurable policy.
Compliance Built In — Not Bolted On
Compliance frameworks and architecture-layer controls, all enforced by design. Enterprise-grade. Architecturally enforced. Always audit-ready.
17 Compliance Frameworks
Built Into the Architecture
- AI governance boundary — agents operate within enforced limits
- CAPA escalation lifecycle — issues escalate automatically
- Training enforcement — expired training blocks the five signing and issuing actions
- EMR roundtrip — certified electronic data exchange
- Multi-site onboarding — governed, scalable by design
- Audit reconstruction — replay any event, any record
- ISO/IEC 17065 framework — certification-body operations
- 21 CFR Part 11 enforcement — mapped to platform controls
- COA integrity verification — an issued COA is write-locked and hash-verified on every read
Every compliance framework is mapped to a platform-layer control — not a policy document. Tamper-evident. Verifiable. Audit-ready from day one. Compliance support varies by module and plan — contact us to discuss your specific requirements.
Security FAQs
The questions procurement and compliance teams ask most.
Can another tenant see my data?
No. Every tenant's data is separated by tenant ID and every query is scoped to the tenant, checked by an isolation test suite on every release. Cross-tenant data access is not possible by design — not just by policy. If you need your data held separately, bring-your-own database and EU hosting give you a dedicated database.
Who at AI Lab Services can access my data?
No one without your explicit authorization. Our staff cannot access your data without a request from your account administrator. All such access is logged.
What happens to my data if I cancel?
Your data remains accessible for 30 days after cancellation. You can export everything in standard formats at any time. After 30 days, your data is securely deleted upon request.
Do you offer a Data Processing Agreement (DPA)?
Yes — and you don't need to ask for it. Every new account signs a DPA electronically during the setup wizard. The signed copy is stored in your account with a full audit record (signer name, IP, timestamp) that you can view and print at any time.
Do you offer a HIPAA Business Associate Agreement (BAA)?
Yes. Clinical operations and any organization handling patient-linked data can sign a BAA during account setup or on request afterward. The BAA is signed electronically and stored permanently in your account. Contact us if you need a countersigned copy for your own records.
Is the platform audit-ready for an FDA inspection?
Yes — and we give you the documentation to prove it. The 21 CFR Readiness Assessment is an AI-powered audit that analyzes your live system data across 10 21 CFR Part 11 categories and returns a scored, printable report with specific findings and recommendations. The Vendor Validation Package (VVP) is a pre-built IQ/OQ/PQ bundle — including a Requirements Traceability Matrix, OQ protocols your quality function executes and signs, PQ templates, and the electronic-signature controls supporting your own §11.100(c) certification — that you complete and file in your Computer System Validation binder. Both are available on the 21 CFR module.
What infrastructure does AI Lab Services run on?
The application layer runs on managed infrastructure in North America. The database layer uses managed cloud infrastructure with encryption at rest by default — enterprise tenants can instead bring their own database and run on it directly, connection string encrypted at rest and tested before activation. Document storage uses your choice of S3-compatible provider. Standard deployments keep all data in North America; EU database residency is available on enterprise deployment. Full architecture documentation is available for enterprise procurement — contact us.
Where is my data hosted?
On standard deployments, all data — databases, documents, and audit logs — is hosted and processed in North America. For EU customers on enterprise deployment, EU database residency in a European region is available, backed by a signed EU DPA incorporating SCC-2021. Enterprise tenants can also bring their own database and host their own data outright. We do not use data centers outside these regions for the managed database.
Does the platform test for attacks, not just correct behavior?
Yes. Every release runs an adversarial test suite that sends injection payloads, probes SSRF protections, tests concurrent race conditions on backup codes, and verifies privilege-escalation attempts are blocked. These run alongside functional tests so security regressions are caught before they ship — not after.
Has the platform been through an independent penetration test?
We run an extensive automated adversarial test suite on every release covering injection, SSRF, mass assignment, separation-of-duties, and race conditions. A formal third-party penetration test is on our roadmap as we scale into enterprise procurement. In the meantime, the adversarial test results are available on request.
Quantum Readiness
AILS tracks NIST PQC readiness across every infrastructure vendor — hosting, database, AI, auth, CDN — and generates a signed Quantum Posture Report for procurement teams.
Hosting & Data Residency
Every tenant's data is separated by tenant ID and every query is scoped to the tenant. EU data residency (Frankfurt) is available on enterprise deployment, and tenants that need their data held separately get a dedicated database through bring-your-own database or EU hosting. Each site tenant has its own users, roles, enabled modules, and accreditation and certificate numbering.
Compliance Ready From Day One
Your DPA is signed during account setup. BAA, SLA, and NDA are available on request.
Security questionnaire responses, an architecture diagram, and our adversarial test results are available for enterprise procurement teams under NDA — contact us.