Application security and regulated-lab controls

Access control

• Role-based permissions down to module and action level (for example, who can approve a calibration or release a certificate).

• Single sign-on via SAML 2.0 / OpenID Connect with Azure AD (Entra ID), Okta and Google Workspace .

• Multi-factor authentication, configurable password policies, account lockout after repeated failed logins, and automatic session timeout.

• Customer portal users see only the assets and certificates their lab chooses to share with them.

• API access uses scoped tokens that admins can revoke at any time.

FDA 21 CFR Part 11 and ISO/IEC 17025 support

• Audit trail: secure, computer-generated, time-stamped records of who created, changed or deleted data, with old and new values and the reason for change. Users cannot edit or delete audit entries.

• Electronic signatures: signatures are linked to the record, show the signer's name, date, time and meaning (such as "reviewed" or "approved"), and require re-authentication.

• Record integrity: approved calibration records and issued certificates are locked; changes create a new revision rather than overwriting history.

• Validation support: we provide release notes and [a validation package / IQ-OQ documentation] to help customers validate metquay.ai under GAMP 5.

Secure development

• Code review on every change, automated dependency and static code scanning, and separate development, test and production environments.

• Production data is not used in development or testing.

• Developers are trained in secure coding against the OWASP Top 10.

Operational security

• People: background checks where lawful, confidentiality agreements, and security training at hire and annually.

• Least privilege: staff access to customer data is limited to what support requires, approved per case, logged and reviewed quarterly.

• Monitoring: centralized logging and alerting on suspicious activity, with logs kept for 12 months.

• Patching: critical vulnerabilities are patched within 7 days, high within 30 days.

• Testing: independent penetration tests annually; summary available to customers under NDA.

• Vendors: subprocessors are reviewed for security before use and bound by data protection terms.

AI security

• AI features process only the data needed for the task you start, such as converting a calibration spreadsheet into a worksheet.

• Customer data sent to AI model providers is not used to train their models and is retained only as their enterprise terms allow confirm.

• AI Output is always shown for human review before it is saved to a worksheet, procedure or certificate.

• AI features can be disabled per account by an administrator.

Incident response

We keep a documented incident response plan that covers detection, containment, investigation and recovery. If a security incident affects customer data, we notify affected customers without undue delay and within 72 hours of confirming it, with what we know and the steps we are taking.

Compliance