Security and product boundaries

MicroCD LabOps is designed around tenant isolation, least-privilege roles, private file storage, and auditable changes. These are engineering controls, not a certification or guarantee of regulatory suitability.

Organization isolation

Every tenant-owned database record includes an organization identifier. PostgreSQL row-level security verifies active membership, while server actions enforce role permissions. Cross-organization identifiers return a not-found response rather than exposing record existence.

Authentication and files

Supabase Auth manages sessions using server-readable secure cookies. Customer files use a private storage bucket and short-lived signed URLs. Service-role, Stripe, email, and AI keys remain server-only.

AI and data-loss prevention

AI is disabled unless configured by an administrator. Quality-document generation transmits public template metadata and an optional screened author instruction; it does not transmit the working draft, project name, files, or linked evidence. Report drafting requires per-request authorization and applies server-side credential blocking and identifier redaction before transmission. Provider response storage is disabled. Pattern detection cannot guarantee identification of every secret or regulated datum, so users must not enter patient data, credentials, or confidential IP.

Controlled document review

Quality documents retain immutable revisions, source provenance, status transitions, and review records. Authors cannot approve their own revision. These controls support a customer validation process; they do not constitute electronic-signature or quality-system certification.

Not a regulated quality system

The launch product is not claimed to satisfy 21 CFR Part 11, ISO 13485, HIPAA, GDPR, FDA, electronic-signature, clinical validation, or any other regulated requirement. Customers must conduct their own risk, privacy, validation, and regulatory assessment.

Report a concern

Send security concerns to info@microcdlabs.com. Do not include secrets, patient information, or regulated production data in the first message.