Security

Encryption

All traffic between your browser and AccreditBook uses TLS. Data at rest, both the database and stored files, is encrypted with AES-256 by the hosting provider. Direct database connections require SSL and are restricted by network rules to the application’s own servers.

Isolation between laboratories

Every record in AccreditBook carries the identifier of the lab it belongs to, and the database enforces row-level security on every table: a query can only return or change rows for labs the signed-in user is an active member of. This is enforced by the database itself, not only by the application.

A hostile-tenant test suite runs on every change before it can be deployed. It signs in as a user of one lab and attempts to read, create, change and delete another lab’s records and files, and requires every attempt to fail. A new table cannot be added without being covered by these tests.

Files

• Files are stored in private storage under a path that begins with your lab’s identifier, and storage access rules check that identifier.
• Downloads use signed links that expire after 10 minutes and are always served as attachments, never displayed inline from the application, which closes off scripts hidden in an uploaded file.
• Uploads are limited to PDF, PNG, JPEG, CSV, XLSX and DOCX, up to 25 MB each. The first bytes of every file are checked against its declared type, and a SHA-256 checksum is recorded.
• Files are not virus scanned in the first version. Uploads come from signed-in users of a paying lab, are only downloaded by that lab or its assessor, are never rendered inline, and executable types are refused. Scanning will be added if customers require it.

Access control

Each user has one role per lab: owner, admin, member or auditor. Members cannot change settings or export the assessor pack; auditors can read everything and download the pack but cannot change anything. Two-factor authentication (TOTP) is available to every user and required for owners of paid labs. Passwords must be at least 12 characters and are checked against known breached passwords.

Audit log

Every insert, update and delete on every record is written to an append-only audit log with the previous and new values, the user and the time. The application provides no way to edit or delete it, and the database rejects such changes. You see it in each record’s Activity tab, and it is included in a full export.

Backups

The database is backed up daily, with backups kept for 7 days, and point-in-time recovery covers the last 7 days. Stored files are copied weekly to a separate storage provider. A restore is rehearsed every quarter and the result recorded in the infrastructure statement of the validation pack.

See Where your data is hosted, Exporting your data and the security overview.