Traceable, verifiable, hosted in Frankfurt
Here is how LabNote.Light implements security — described in detail and verifiable.
EU-hosted · GDPR · · Hash-chain v2
Security & Compliance
Built into every plan, not bolted on
GDPR, ALCOA+, and the hash-chain audit trail ship with every LabNote.Light plan — no add-ons, no surcharge, EU-hosted.
Security Principles
Encryption
All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). No third-party access to plaintext data.
Role-Based Access Control (RBAC)
Three roles — Admin, Researcher, Reviewer — control access at the organization level. Every database query is enforced server-side via Row-Level Security (RLS).
Electronic Signatures
Password re-authentication for every signature. SHA-256 content hash plus hash chain per organization for cryptographic tamper evidence. Simple electronic signatures.
Audit Trail
Every change (create, edit, delete, status change, signatures) is immutably logged with user ID, timestamp, and action. No log can be deleted or modified.
No Anonymous Access
Anonymous sign-ups are disabled. Every access requires a verified email address and password authentication.
Infrastructure & Operations
EU Cloud Hosting
Hosted on Lovable Cloud / Supabase on AWS infrastructure within the European Union. Encrypted backups. Data Processing Agreement (DPA) per GDPR Article 28 available on request.
Database Security
PostgreSQL with Row-Level Security on every table. All sensitive fields (OAuth tokens, API keys, webhook secrets) are stored encrypted.
Backups
Regular automatic database backups by the cloud provider. Extended backup options (point-in-time recovery, longer retention) available depending on plan.
Edge Functions with JWT Validation
All API endpoints validate JWT tokens server-side. No endpoints without authentication (except public marketing pages).
Compliance & Certifications
Data protection
Role-based access, recorded change history, data portability (CSV/PDF/Markdown export), deletion on request (anonymization for signed entries), data processing agreement under Art. 28 GDPR on request.
GLP/GMP Support
Electronic signatures, versioning, freeze-on-sign, audit trail, and tamper-evidence hashing support documentation requirements under GLP and GMP.
Password Security
Passwords are checked against the Have-I-Been-Pwned (HIBP) database. Compromised passwords are rejected during registration and password changes.
OAuth 2.0 & SSO
External integrations use OAuth 2.0 with PKCE. SAML SSO available for enterprise customers. Personal Access Tokens for API access.
Request security documentation
DPA under GDPR Art. 28, subprocessor list, security whitepaper and custom compliance requirements — directly from the legal team.