Status: Available (describes implemented controls; not a compliance certification)

This page only documents controls that can be verified from the repository. It does not claim SOC 2, HIPAA, GDPR certification, or specific data-residency guarantees unless configured and documented by your operator.

Access controls

Sign in with email and password. New accounts join by invitation.
Authorization uses organization, lab, and project roles.
External collaborators do not inherit open-lab projects. They need an explicit project role.

Tenant / organization separation

Data access is scoped through membership tables (org, lab, project). Shared infrastructure (database, object storage bucket) may be multi-tenant at the deployment layer; logical separation relies on application authorization checks.

Audit logs

Project Logs show project-visible activity.

Authentication

See Getting started. Password reset uses an emailed link. There is no self-serve partner API-key program.

File and object storage

File storage is managed by the platform. Access to objects goes through the product and any share links you issue.

Data residency

Hosting region depends on your deployment or workspace plan. This page does not promise a specific region.

Provenance

Analysis runs, artifacts, insights, labbook/Ovaition links, and memory decisions participate in scientific provenance where enabled.

Deletion and export

Deletion and export behavior depends on the specific object APIs and UI actions. Do not assume soft-delete, hard-delete, or bulk export exists for every entity. Confirm per surface before relying on it for records management.

AI data handling

The assistant only uses projects you can access. Remote MCP is not a partner product and does not return project, experiment, or dataset tools.