Security & Trust — GxP-Desk

21 CFR Part 11 · EU GMP Annex 11 · GAMP 5 · ALCOA+

Re-authenticated signatures · Tamper-evident audit trail · Security practices (not certified)

01 — Standards & frameworks

Security measures and customer responsibilities are described in the published DPA.

SOC 2

No SOC 2 attestation report

We do not hold an independent SOC 2 attestation report. The DPA describes technical measures and contractual obligations; these do not constitute an external attestation.

No attestation report

ISO 27001

No ISO 27001 certification

We do not hold ISO 27001 certification. The security measures described in the DPA include access controls, tenant isolation and encrypted backups.

Not certified

GDPR

GDPR-aligned data protection

Processing practices designed around GDPR principles. Our standard Data Processing Agreement under Art. 28 GDPR, including the sub-processor list in Annex 3, is published on this website. Data separation is logical today — see Data residency below.

DPA published

EU AI Act

Optional AI with human review

AI functions require an administrator to configure the customer’s own provider API key. Inputs, context and results are logged. Results are suggestions requiring human review and approval; the customer’s contract governs the AI provider’s retention and training practices.

BYOK · Human approval required

02 — Regulatory alignment

Built against the regulations validation teams actually defend.

21 CFR 11

Electronic records and signatures

Electronic signatures with re-authentication and a hash-chained, append-only audit trail support the customer’s validation against 21 CFR Part 11. Compliance depends on the customer’s use, validation and procedures.

EU GMP

Annex 11 aligned

Risk-based validation, signature linking, periodic review, supplier qualification and incident management aligned to EU GMP Annex 11. Pre-built Annex 11 control matrix included.

GAMP 5

GAMP 5 (2nd ed.) v-model

Lifecycle phases — Concept, Project, Operation, Retirement — modelled in the platform. ISPE GAMP 5 categorisation (1, 3, 4, 5) drives default validation depth.

ALCOA+

Data integrity by default

Attributable, Legible, Contemporaneous, Original, Accurate — plus Complete, Consistent, Enduring, Available. Built into the audit data model.

03 — Controls

Six categories, twenty-four controls — some live today, others on our roadmap.

Encryption

Data at restNot encrypted per-tenant today; AES-256 per-tenant encryption at rest and customer-managed keys (BYOK) are on our roadmap.
Data in transitHTTPS only: TLS 1.2 and 1.3 with HSTS on all endpoints
BackupsEncrypted full backups (AES-256-GCM) are created with every release and stored on the production server in Falkenstein, Germany. Retention is set to 30 days; older backups are deleted at the next backup run. There are no off-site or geo-redundant copies.
SecretsNo long-lived credentials in code paths; secrets provided via environment configuration

Identity

AuthenticationJWT-backed sessions with Argon2id password hashing
MFATOTP available; enforcement is an account-wide toggle, not limited to privileged roles
SessionsConfigurable timeout and idle lock
Account modelAccount ▸ Tenant scoping; user lifecycle managed in-app

Access control

RBACTenant-scoped roles with least-privilege defaults
Separation of DutiesEnforced at workflow layer — author ≠ approver
Privileged accessAccount/system admin bypass access exists today; reason-code logging for that access is being rolled out.
Customer supportPrivileged admin access exists today — it is not zero-standing; we are bringing it under reason-code audit logging.

Monitoring

Audit logAppend-only event capture across all GxP entities
Tamper-evidenceHash-anchored audit entries with periodic verification
Inspector exportsOn-demand audit bundle export (DOCX / PDF / JSON)
Status pagePublic status page not yet available; planned.

Resilience

Uptime SLANo contractual uptime SLA today; reliability targets are on our roadmap.
RPO / RTONo formal RPO/RTO commitments today; disaster-recovery targets are in development.
DR drillsNot yet formalized; planned as part of our resilience roadmap.
BackupsFull encrypted backups are created with every release, not daily, on the same production server in Germany. Retention is set to 30 days; older backups are deleted at the next backup run. No off-site copies.

AppSec

SDLCCode review before merge, automated dependency auditing and secret scanning in CI; SAST/DAST automation is planned.
Pen testsInternal security review checklist today; independent third-party penetration testing is planned. No bug bounty program.
DependenciesAutomated dependency vulnerability scanning in CI; SBOM publication and a formal CVE response SLA are planned.
Secret hygieneNo long-lived credentials in code paths

04 — Data residency

Hosted in Germany. Separated logically, not physically.

GxP-Desk runs on servers of Hetzner Online GmbH in Germany: application, databases, uploaded files and backups in the Falkenstein data center, the transactional mail server in Nuremberg. Tenants share this infrastructure and are separated logically through tenant-bound database access, not by dedicated servers. No US data plane is in operation. The exceptions are set out in the DPA: bug-report summaries users choose to submit (GitHub, USA) and recipients you configure yourself, such as your AI provider.

RegionLocationWhat this means today

EU — GermanyHetzner · Falkenstein (mail: Nuremberg)Applies to every tenant. The control plane and the EU data plane run logically separated on the same host, together with uploaded files and backups.

USNot in operationThe US data plane is disabled. Bug-report summaries may be stored at GitHub in the USA; customer-selected recipients, including AI providers, may also process data outside the EU/EEA. See the DPA.

05 — Procurement pack

The paperwork your CFO and InfoSec lead will ask for.

The Terms of Service and the Data Processing Agreement that apply to every contract, including the free trial, are published online. The DPA and MSA PDFs below are templates for individually negotiated agreements; the business case template is downloadable too. Individually agreed provisions take precedence.

DOCUMENT · CS-LEG-0001