AiLabrix is engineered to meet the security and privacy expectations of EU research laboratories, accredited medical labs, and pharma R&D teams. Every control below is implemented in code, not in a slide deck.
AiLabrix carries an explicit "research-use only" classification. Within that scope, the technical controls below are implemented and verifiable. Certification of the deploying organisation against any framework remains the organisation's responsibility.
Regulation (EU) 2016/679 — personal-data protection.
ReadyMedical laboratory quality & competence.
AlignedInformation-security management.
Annex A mapped42 CFR Part 493 — US clinical labs.
Out of scopeEU GMP Annex 11, ALCOA+ data integrity.
Cat. 5 controlsFDA e-records / e-signatures.
Out of scopeApplication security baseline.
MetMethod-validation guidance (informative).
Math built-inConcrete defences. Each item is implemented in code and present at HEAD of the production branch. Detailed evidence is available under NDA.
Every state-changing action writes a SHA-256-chained audit row. On-demand verification confirms chain integrity in milliseconds. ALCOA+ Original principle met by construction.
Argon2 password hashing, 12-character policy with rotation, TOTP MFA with AES-encrypted secrets at rest, role-based access control, account lockout, rate limiting, re-authentication on critical actions.
EU mode forces local-only LLM (Ollama) for zero data egress. Pre-LLM pseudonymisation scrubs identifier-like fields. Full data-subject rights endpoints (access, erasure, portability, restriction) under /api/dsr/.
CycloneDX SBOM regenerated on every push to main. Pinned Python dependencies. CSP, HSTS, CSRF, X-Frame-Options enforced via Flask-Talisman. Container runs as non-root.
The 21-stage pipeline gates every LLM-authored output behind mandatory human review. No solely-automated decision-making within the meaning of GDPR Art. 22. Prompt-template versioning logged on every call.
Per-record-type retention configurable from the UI, enforced by a nightly cron. Three pre-built compliance profiles (research / GxP-lab / regulated) with audit-logged transitions.
AiLabrix is single-tenant and self-hosted. Below is the complete list of external services that may receive deployment data only when a deploying organisation explicitly enables them. The default privacy posture for EU deployments routes everything to a local model with zero egress.
Each opt-in sub-processor is gated behind a signed Data Processing Agreement (Art. 28) including Standard Contractual Clauses Module Two. EU deployments may set AILABRIX_EU_MODE=1 to disable all cloud providers and force local Ollama. Detailed vendor-qualification evidence is available on request.
AiLabrix is software the deploying organisation runs inside its own perimeter. The boundary below describes the joint operating model.
The public posture above is the surface. The full dossier carries every control with file:line evidence, the live audit-chain verification log, and the per-framework gap analysis your security and procurement teams will ask for.