Security

Your laboratory data is protected at every layer

Security is not an add-on at BLIMS — it is the foundation. From tenant-level database isolation to end-to-end encryption and immutable audit logs, we take data security as seriously as your accreditation body does.

Tenant isolation

Each laboratory workspace lives in a dedicated PostgreSQL schema
No shared tables between tenants — structural isolation at the database level
Tenant resolution validated on every API request
Cross-tenant data access is architecturally impossible

Encryption

AES-256 encryption at rest for all stored data
TLS 1.3 for all data in transit
Encrypted backups with separate key management
Passwords hashed with bcrypt (never stored in plain text)

Authentication

TOTP-based two-factor authentication (2FA) for all users
One-time backup codes for 2FA recovery
Short-lived JWT access tokens with refresh token rotation
Session invalidation on password change or logout

Audit trails

Every record creation, modification, and deletion is logged
Logs are immutable — they cannot be edited or deleted through the UI
Full who-did-what-when traceability for ISO 17025 requirements
Electronic signatures captured with timestamp and identity proof

Access control

Role-based permissions enforced at every API endpoint
Authorities matrix controls approval workflows
Principle of least privilege: users only see what they need
Admin actions require elevated confirmation

Infrastructure

Hosted in SOC 2 Type II certified data centres
Automated daily backups with point-in-time recovery
DDoS protection and Web Application Firewall (WAF)
Security patches applied within 24 hours of release

Responsible disclosure

If you discover a security vulnerability in BLIMS, please report it to us privately before public disclosure. We will acknowledge your report within 24 hours and work with you to verify and resolve the issue. We do not take legal action against researchers acting in good faith.

Report a vulnerability — [email protected]