help · compliance
know what is enforced.
know what is still in progress.
the current controls, readiness status, and boundaries for regulated research.
status, framework by framework.
- in progress
21 CFR Part 11
FDA requirements for electronic records and signatures in regulated research. the audit trail is live; electronic signatures and enforced retention are not yet available
- Today: hash-chained audit trail for every signed-in run (§11.10(e))
- Today: chain segments time-stamped by an outside time-stamping authority
- Today: verify a chat's record yourself, from your own account
- Today: unique user identification and role-based access controls (§11.10(d), (g))
- Today: per-job export with inputs, parameters, audit trail and checksums (§11.10(b))
- Not yet: electronic signatures (§11.50, §11.70)
- Not yet: enforced retention periods and legal holds (§11.10(c))
- Not yet: a supplier validation package (§11.10(a))
- in progress
SOC 2 Type II
Trust services criteria for security, availability, and confidentiality
- Access control policies
- Change management procedures
- Risk assessment framework
- Incident response procedures
- Encryption in transit
- Monitoring and logging
- planned
HIPAA
Planned — technical safeguards for protected health information; not available today
- Access controls and audit logs
- Automatic session timeouts
- Data encryption requirements
- Business associate agreements
- Breach notification procedures
- Workforce training records
- in progress
GxP Practices
Good practice guidelines for regulated life sciences workflows
- Today: traceability from each answer to the tool runs behind it
- Today: tamper-evident record of every signed-in run
- Not yet: validated computational methods
- Not yet: change control, deviation and training records inside Ivy
- Not yet: quality system integration
check the record yourself.
the principles every control answers to.
- defense in depth
multiple layers of security controls — from network to application to database. no single point of failure means attackers face obstacles at every step.
- least privilege
users and systems only get the minimum access needed. role-based controls, row-level security, and scoped tokens ensure data stays compartmentalized.
- zero trust
every request is verified, every session is validated. we don't assume internal traffic is safe — continuous authentication keeps your data protected.
- transparency
signed-in runs leave a tamper-evident record you can check. edit a row and the chain breaks at the verifier. it detects modification; it does not prevent it, and it is not access control.
the controls, one line each.
- multi-factor authentication
- enterprise-grade identity management with time-based one-time passwords, hashed backup codes, and session management with geographic tracking.
- role-based access control
- hierarchical permission system with organization-scoped access patterns. users only access what they need.
- row-level security
- database-enforced data isolation. users only see their own data; organizations are fully segmented at the database level.
- comprehensive audit logging
- hash-chained, timestamped audit trails tracking authentication events, data access, job execution, and administrative actions with severity levels.
- secure service authentication
- cryptographic signature verification for service-to-service communication with timing-safe comparison and per-service credentials.
- rate limiting & protection
- multi-layer rate limiting with presets for different access patterns. includes burst protection and security probe detection.
- input validation
- runtime schema validation for all API inputs. tool-specific schemas prevent injection attacks and ensure data integrity at system boundaries.
- data integrity verification
- content hashing for report versioning, file ownership validation, and tamper detection you run yourself: re-check a job, report or chat against its hash chain from your own account.
- threat detection
- real-time IP blocking with severity classification and action history. geographic request tracking for anomaly detection.
- verifiable audit trail
- every event of a signed-in run is hash-chained, and each chain segment is time-stamped by an outside authority. verify a chat from your own account at /audit/verify; the mechanism and its limits are in the audit-trail docs.
- security monitoring
- audit events with forwarding capabilities and correlation IDs for security information and event management integration.
- identity verification
- document-based identity verification for high-security workflows requiring enhanced user authentication.