Security you can point at.
Database-enforced tenant isolation, invite-only onboarding, TOTP two-factor, granular role scoping and an append-only audit log written by database triggers.
Isolation at the database layer
Every workspace-scoped table carries a workspace key and is protected by row-level security policies evaluated on each query. Isolation does not depend on application code remembering to filter.
Invite-only onboarding
There is no open sign-up. The platform owner invites the first administrator of a workspace; that administrator invites their own team. Invites are single-use, expiring and bound to an email address.
Two-factor authentication
Password and magic-link sign-in with TOTP second factor, enforceable per role. Sessions are workspace-scoped: users land in their own workspace and nowhere else.
Granular permissions
Eight role templates as a starting point, refinable down to object, field and row scope — so a workspace administrator decides exactly what each of their users can see and do.
Immutable audit trail
Inserts, updates and deletes are captured by database triggers into an append-only log with actor, before/after state and timestamp. Records cannot be edited or removed from the application.
Separated control plane
Platform administration is a distinct surface from tenant business data, so operating the platform does not mean browsing customers' operational records.
select * from sites
↳ workspace membership required
↳ permission: sites.read
↳ row scope: assigned accounts only
→ 42 of 212 rows returned
cross-workspace read → 0 rows, always, regardless of query
Paperwork and PHI
DocLab Solutions is an operational system: accounts, sites, projects, equipment, reagent lots, tickets, documents and regulatory records. It is not intended to hold patient-identifiable clinical results by default.
Where a workspace must handle protected health information, GPenda Technologies offers a HIPAA-aligned configuration under a signed Business Associate Agreement — restricted hosting region, extended audit retention and per-field access controls. That configuration is available at additional cost. Email info@gpendatechnologies.com and we will send the current BAA and DPA drafts for your counsel to review, along with a data-flow description for your workspace.