Security and trust centre
How we protect your laboratory's data
Health data deserves engineering, not adjectives. Here is exactly what we do, what we do not do yet, and how to reach us if you find a problem.
Encryption
TLS 1.2 or later in transit. At rest, patient identifiers, clinical details, report bodies and uploaded files are encrypted with AES-256-GCM using keys derived per purpose (HKDF) from a master key held only on the server. Encrypted fields stay searchable through keyed blind indexes, so we never need to decrypt to search.
Laboratory isolation
Every record carries its laboratory's identifier and PostgreSQL row-level security, forced on every table, hides other laboratories' rows whatever the application asks for. The application connects with a role that cannot bypass these rules, and automated tests try to cross between laboratories on every release.
Sign-in and sessions
Two-factor sign-in is mandatory for every user: an authenticator app with recovery codes, or a six-digit emailed code that expires in ten minutes, works once and is cancelled by any newer code. Passwords are hashed with argon2id and need 12 characters; five failures lock the account for 15 minutes. Sessions end after 30 minutes of inactivity or 12 hours.
Audit trail
Sign-ins, views, changes, exports and authorisations are recorded with user, time, IP address and browser. Database triggers refuse any change or deletion of the audit record. Authorised report versions are immutable, and clinical records are archived, never deleted, while an account is open.
Infrastructure and backups
Servers in Germany (EU) behind Cloudflare's network for TLS and attack protection. Nightly encrypted database backups, kept in the same region. Uploads are virus-scanned. A strict Content Security Policy and rate limits protect the web application.
Data protection
For patient and laboratory records you are the controller and Visiopath Ltd is your processor under UK and EU GDPR. Our data processing agreement applies to every laboratory automatically. We publish our sub-processors and give 30 days' notice of changes.
Data location and sub-processors
Where your data lives
Your records stay in our EU hosting. Only the services below process data on our behalf, each for a narrow purpose.
| Service | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Servers and backups | Germany (EU) |
| Cloudflare, Inc. | DNS, TLS and attack protection | Global network |
| Google LLC | Sending system emails | EU and USA (UK IDTA / EU Standard Contractual Clauses) |
| Stripe, PayPal | Donations only, never clinical data | Independent controllers |
Certifications
Our compliance roadmap
We do not display badges we have not earned. This is where we are.
- Cyber Essentials
- Planned first
- Cyber Essentials Plus
- Planned
- ISO/IEC 27001
- On the roadmap
- Independent penetration test
- Before general availability; summary published here
- Accessibility
- WCAG 2.2 AA target; statement
Export everything
Download all your laboratory's records as JSON and CSV, plus report PDFs, whenever you like, at no cost. How to export.
Responsible disclosure
Found a vulnerability? Email [email protected]. We acknowledge within three working days and offer safe harbour for good-faith research. Policy · security.txt.
Clinical responsibility
VipLIMS records and presents your information; it does not make clinical decisions. Laboratories validate the system for their own use. Medical disclaimer.
Questions from your information governance team?
We will answer security questionnaires and DPIA questions for laboratories considering VipLIMS. Send them to us and we will reply in writing.