Implemented engineering controls
- Repository security scanning and release checks are part of the engineering workflow.
- Production changes are reviewed through version control and CI before deployment.
- Application secrets are supplied through environment configuration rather than intentionally embedded in public client code.
- Workspace-aware database helpers exist to support scoped database access during the ongoing tenant-isolation rollout.
- Evidence, lineage, and production-smoke checks are treated as release gates for scientific functionality.
Current enterprise boundary
GaiaLab is suitable today for public or non-confidential research exploration and bounded validation pilots. Until authenticated organizational identity and database-level tenant isolation are fully deployed and verified, customers should not submit PHI, patient-identifiable data, trade-secret datasets, or other confidential regulated information unless a written agreement explicitly defines the approved workflow and controls.
Tenant isolation
GaiaLab has implemented workspace-scoped database transaction support and has designed row-level-security policies. Database-level RLS remains a staged control and is not represented here as fully deployed across every workspace path. Enterprise confidential-data use will not be marketed as ready until that rollout is complete and tested.
Authentication and auditability
Public research exploration intentionally supports low-friction access. Paid institutional workflows require a stronger identity and audit model. Durable authenticated identity, team-level access boundaries, and user-attributed audit events are part of the pharma-readiness gate.
Vulnerability reporting
Security reports may be sent to security@gailabai.com. Please provide enough detail to reproduce the issue and allow reasonable time for investigation before public disclosure.
What GaiaLab does not claim
- SOC 2 certification
- ISO 27001 certification
- HIPAA compliance
- GxP validation
- 21 CFR Part 11 compliance
- FDA qualification or regulatory approval