Security & Compliance

Enterprise-Grade Security for Pharmaceutical Data

Row-level data isolation, encrypted communications, and compliance-ready architecture — designed from day one for the regulatory demands of the life sciences industry.

Data Protection

Multi-layered security controls protect your trial intelligence

Row-Level Security

Every user's data is isolated at the database level through PostgreSQL Row-Level Security (RLS) policies. Followed trials, custom columns, confirmations, preferences, and portfolio configurations are scoped to individual accounts. No user can access another user's data — enforced by the database engine, not application logic.

Authentication & Session Management

  • Built on Supabase Auth with asymmetrically-signed (RS256/ES256) JWTs and a published JWKS public key — no custom auth server to compromise
  • Short-lived access tokens (1 hour) with refresh tokens that rotate on every use; email confirmation is required at sign-up
  • Single sign-on across ClinicaLister — one session spans the app, the account hub, and the AI connector; SAML / OIDC SSO is available for organizations
  • Global sign-out invalidates the session across every device and tab at once

Multi-Factor Authentication

  • Optional TOTP two-factor authentication, enforced consistently across every ClinicaLister app
  • Required for administrators — no admin action proceeds without a verified second factor
  • Self-service, one-time recovery codes (stored only as salted hashes) so a lost authenticator never means a lost account
  • Sensitive actions step the session up to a higher assurance level before they run

Account & Device Protection

  • Trusted-device management — review, rename, and revoke every device on your account from one security dashboard
  • Device binding via RFC 9449 DPoP proof-of-possession, using device-bound, non-extractable keys
  • Sign-in alerts by email when your account is accessed from a new device or country
  • Revoking a device cascades across apps — it immediately disconnects any linked AI-assistant (Model Context Protocol) session and its refresh tokens

Access Control (RBAC)

  • Role- and tier-based access control governs what every account can see and do
  • Tool-group scoping controls exactly which tools each seat — or each connected AI agent — is allowed to call
  • Re-authentication required before high-risk actions such as data export, account deletion, or billing changes
  • Service-to-service calls between internal systems are signed with HMAC

Encryption

  • In transit — All communications between client and server are encrypted via HTTPS/TLS
  • At rest — Database storage uses encrypted volumes with AES-256 encryption
  • Data-source connections — All third-party data-source integrations use encrypted HTTPS connections

Content Security Policy

  • Content Security Policy (CSP) headers to prevent cross-site scripting
  • X-Frame-Options to prevent clickjacking
  • X-Content-Type-Options to prevent MIME sniffing
  • Strict-Transport-Security for HTTPS enforcement

Application Security Hardening

OWASP-aligned protections across the real-time search path and long-running session lifecycle

Hardened Real-Time Search

ClinicaLister's real-time search backend is hardened against the OWASP Top 10 and integrated with the application through a secure, authenticated client connection.

  • Strict authentication envelope — Every real-time session begins with an authenticated handshake validating signature, expiration, and issuer; no session data is transmitted before the server acknowledges authentication
  • Scoped rate limiting — Rate limits are applied per endpoint with server-provided retry hints, ensuring a burst on one capability never blocks unrelated operations
  • Enumeration-safe error handling — Authorization and not-found responses are coalesced into a single message so attackers cannot distinguish which queries exist
  • Query ownership verification — Every search and follow operation verifies the authenticated user owns the target query at the database level; cross-user access returns the same safe error as a non-existent resource
  • Parameterized queries and field allowlists — All database access uses parameterized statements, with field names validated against an explicit allowlist before SQL interpolation
  • Information-disclosure prevention — Diagnostic endpoints require authentication, rate-limit headers are suppressed in production, and error responses never expose internal details

Session Resilience

Long-running searches gracefully recover from transient disruptions without losing progress or leaving stale server sessions behind.

  • Mid-session recovery — If a session needs to refresh during an in-flight search, it renews transparently and resumes from where it left off
  • Graceful cancellation — Navigating away from an active search sends a clean cancellation signal so server resources release immediately
  • Resilient retry — Exponential backoff with server-provided hints prevents retry storms that would burn shared rate-limit budgets

Privacy & Governance

Transparent data handling with regulatory compliance built in

GDPR & Data-Subject Rights

Built to GDPR expectations. Consent is granular — analytics and marketing are opt-in and default off — and every consent change is written to an immutable consent audit log. You can exercise your rights of access, rectification, erasure, and objection (GDPR Articles 15–21) from your account, with sensitive requests re-authentication-gated. A Data Protection Officer is designated and a Data Processing Agreement is available for organizations.

Data Retention & Breach Response

Automated data-retention policies run on a scheduled job so personal data is never kept longer than needed. A breach-incident register and subject-notification workflow support the 72-hour GDPR breach-notification standard, and Records of Processing Activities (RoPA) are maintained.

Private User Actions

User confirmations and rejections of AI suggestions are stored privately and aggregated anonymously. No user can see another user's individual voting activity — only aggregate community metrics (total confirmations, total rejections, approval rate) are visible.

Audit Trail

Change logging tracks data modifications for regulatory compliance, and high-risk account actions are recorded in a structured activity log. The monitoring system records when trial data was last synchronized, what fields changed, and the before/after values — a verifiable record of data evolution.

Environment Isolation

Development and production environments are fully isolated with independent data stores, separate authentication systems, and distinct access controls. No development activity can affect production data. Error monitoring receives only an anonymous user ID — never your email or personal data.

Compliance Posture

ClinicaLister is actively working toward SOC 2 Type II, with a documented roadmap and controls mapped to the Trust Services Criteria; authentication targets NIST 800-63B AAL2 and controls are designed against the OWASP ASVS and OWASP Top 10. We are not yet SOC 2 certified. Our core infrastructure providers — Supabase, Cloudflare, and Render — each maintain their own SOC 2 Type II attestations.

Infrastructure

Enterprise-grade hosting and database architecture

Hosting & Availability

  • Cloud hosting on enterprise-grade infrastructure with automated scaling
  • Redundant data storage with continuous backups
  • Global CDN for fast content delivery across regions
  • Automated health monitoring with live status tracking

Database

  • PostgreSQL — Enterprise-grade relational database with ACID compliance
  • Row-Level Security enforced at the database engine level
  • Automated backups with point-in-time recovery capabilities
  • Connection pooling for optimal performance under concurrent load

Mobile Experience

ClinicaLister delivers full feature parity across all devices — ensuring field teams, executives, and analysts have equal access regardless of device.

Smartphone

  • Bottom tab navigation for easy one-handed access
  • Card-based layouts optimized for touch interaction
  • Touch-optimized controls with appropriately sized tap targets
  • Mobile-optimized calendar with quick date presets
  • Adaptive dialogs that scale to screen dimensions

Tablet & Desktop

  • Multi-column layouts for dense information display
  • Full table views with expanded column visibility
  • Persistent sidebar navigation for quick access
  • Chart maximize/minimize for detailed analysis on demand

Responsive View Toggle

Switch between table and card views on any screen size. The preference persists across page navigations for a consistent experience.

Questions about security or compliance? We're ready to discuss.