Security you can point at.

Database-enforced tenant isolation, invite-only onboarding, TOTP two-factor, granular role scoping and an append-only audit log written by database triggers.

Isolation at the database layer

Every workspace-scoped table carries a workspace key and is protected by row-level security policies evaluated on each query. Isolation does not depend on application code remembering to filter.

Invite-only onboarding

There is no open sign-up. The platform owner invites the first administrator of a workspace; that administrator invites their own team. Invites are single-use, expiring and bound to an email address.

Two-factor authentication

Password and magic-link sign-in with TOTP second factor, enforceable per role. Sessions are workspace-scoped: users land in their own workspace and nowhere else.

Granular permissions

Eight role templates as a starting point, refinable down to object, field and row scope — so a workspace administrator decides exactly what each of their users can see and do.

Immutable audit trail

Inserts, updates and deletes are captured by database triggers into an append-only log with actor, before/after state and timestamp. Records cannot be edited or removed from the application.

Separated control plane

Platform administration is a distinct surface from tenant business data, so operating the platform does not mean browsing customers' operational records.

audit_log / append-only
UPDATEcontractsrenewal_date 2026-03-01 → 2027-03-01
INSERTtasks6 rows · ai-assisted · approved by j.reyes
DELETEsite_contactsblocked — insufficient permission
UPDATEmembershipsrole read_only → support_engineer
rls / policy evaluation

select * from sites

↳ workspace membership required

↳ permission: sites.read

↳ row scope: assigned accounts only

→ 42 of 212 rows returned

cross-workspace read → 0 rows, always, regardless of query

Paperwork and PHI

DocLab Solutions is an operational system: accounts, sites, projects, equipment, reagent lots, tickets, documents and regulatory records. It is not intended to hold patient-identifiable clinical results by default.

Where a workspace must handle protected health information, GPenda Technologies offers a HIPAA-aligned configuration under a signed Business Associate Agreement — restricted hosting region, extended audit retention and per-field access controls. That configuration is available at additional cost. Email info@gpendatechnologies.com and we will send the current BAA and DPA drafts for your counsel to review, along with a data-flow description for your workspace.