Data isolation per organisation
Data access is restricted in the database by organisation and business context, supported by server-side helper functions. Automated probes cover a substantial, but not complete, portion of individual rules.
IT security
Controls that can be assessed directly
This overview describes the current technical state of LabNote.Light. It separates available controls from organisational evidence and services that are not generally committed.
As of October 2026 · Early access
Current state
Core controls at a glance
These statements apply to the offered cloud deployment. Each organisation must assess suitability for its specific regulated process.
- Tenant isolation
- Database and server-side permissions
- Authentication
- Email, password and optional TOTP MFA
- Data storage
- Supabase on AWS in Frankfurt
- Change evidence
- Audit trail with hash chain
Access and tenant isolation
Permissions are enforced server-side
Organisation, role, capabilities and, where applicable, department determine effective access. The user interface is not the security boundary.
Roles and capabilities
System and custom roles control individual capabilities. Roles are stored separately from the user profile; administrative actions are also checked server-side.
MFA and sessions
TOTP through an authenticator app is available. Organisations can require MFA for administrative access. A configurable inactivity timeout signs users out; sensitive signatures require re-authentication.
Controlled support access
Privileged support access uses short-lived hand-offs, requires strong authentication and is logged as a distinct event. Customers can review recorded support access for their organisation.
Integrity and traceability
Changes and approvals remain reviewable
The controls are designed to make subsequent changes detectable. They do not replace technical review and do not constitute a statement of legal conformity.
Audit trail
Relevant creates, updates, deletions, status changes and signatures are recorded with the person, time, action and affected values. Coverage depends on the record type and is not identical for every table.
Hash chain and time anchoring
Audit entries are chained per organisation using SHA-256. Verification detects breaks, and the current chain state is regularly anchored to an external time source. This provides tamper evidence, not a guarantee of technical immutability.
Simple electronic signatures
Signatures record the person, time, meaning and a snapshot of the content, among other details. Password confirmation and, when MFA is enabled, an additional factor protect the signing step. This is not a qualified electronic signature.
Data and operations
Technical operation with clearly stated dependencies
LabNote.Light uses managed services. Data location, provider access and application controls are therefore described separately.
Data location and providers
The database, authentication, file storage and server-side functions are provided through Supabase on AWS in Frankfurt. The application is delivered through Lovable Labs Sweden. Third-country access, particularly for support or additional enabled services, cannot be excluded and is described in the privacy notice and DPA.
Transmission and storage
Connections to the application are encrypted in transit. The infrastructure providers encrypt the database, files and backups at rest. Credentials for selected integrations receive additional application-level protection.
API and outgoing webhooks
API requests use sessions or personal access tokens with restricted permissions. Outgoing webhook deliveries are signed with HMAC-SHA256 and a timestamp; delivery attempts and failures are logged.
Export and deletion
Administrators can initiate an organisation export containing tables and related files. Account deletion follows a defined plan of deletion, anonymisation or replacement; audit events are anonymised rather than removed to preserve chain integrity.
Assurance status and boundaries
What this page deliberately does not claim
Internal reviews and technical controls are not independent certification. These boundaries matter for risk and vendor assessments.
No own ISO 27001 or SOC 2 certification
LabNote.Light and Blck Horizon Solutions currently hold neither their own ISO 27001 certification nor their own SOC 2 report.
No completed external penetration test yet – planned for Q4 2026
An external penetration test of the platform is planned for Q4 2026 and has not yet been completed. Until then, internal testing and infrastructure-provider reports do not replace this evidence.
SSO subject to technical assessment
SSO is not a general self-service feature. Availability depends on the identity provider and infrastructure plan and is assessed for each organisation.
No general SLA or self-hosting commitment
Availability, measurement point, maintenance windows and remedies are not defined in a general SLA. An SLA is available for Priority on request. Self-hosting is not currently offered as a product commitment.
Public evidence
Contract and operating information
DPA
Data processing under Article 28 GDPR, including technical and organisational measures and sub-processors.
Open DPAPrivacy
Processing purposes, recipients, third-country access, retention periods and data-subject rights.
Read privacy noticeAPI documentation
Available endpoints, authentication and integration boundaries.
Open API documentationSecurity report
Report a vulnerability confidentially
Please send technical details, affected areas and reproducible steps to security@labnote-light.com. Do not disclose customer data or credentials.