Security, data integrity & compliance
Aliquora is built around the data-integrity controls that regulated and quality-driven labs depend on — electronic signatures, an append-only audit trail, tamper-resistant records, and strict access control. Here's exactly what's in place today, and where we're headed.
Request our security & compliance packetBuilt-in data integrity controls
Every feature below is live in the product today — the controls auditors and quality teams look for, built in rather than bolted on. Electronic signatures and approval workflows are available on every plan.
Electronic Signatures
Sign-off actions are captured as electronic signatures that record who signed, when, and the meaning of the signature (e.g. reviewed, approved). The signer re-enters their password at the moment of signing, and each signature is cryptographically bound to a snapshot of the record it applies to — so any later change to that record is detectable. Available on every plan.
- Password re-authentication required for every signature
- Captures signer identity, timestamp, and signature meaning
- Cryptographically bound to a snapshot of the signed record (tamper-evident)
Append-Only Audit Trail
Key actions are written to a computer-generated, time-stamped audit log. The application provides no interface to edit or delete audit entries.
- Records who performed each action, when, and from where
- Captures sample creation, result entry, edits, and approvals
- Exportable to CSV for your own review and record-keeping
Tamper-Resistant Records
Once a result is verified or an entry is signed, the application blocks further edits to that record. Unlocking a verified result requires an administrator to re-enter their password and record a reason, and the unlock is written to the audit trail.
- Signed entries cannot be edited through the application
- Verified results are locked against modification until explicitly unlocked
- Unlocking requires password re-authentication, a documented reason, and an audit entry
Role-Based Access Control
Assign users to roles that match how your lab operates. Control who can create samples, enter results, approve reports, or manage settings.
- Admin, technician, reviewer, and read-only roles
- Permissions tied to specific actions (create, edit, approve)
- Authority checks enforced on the server for every request
Secure Authentication
Accounts are protected with hashed passwords, session management, and automatic lockout to help prevent unauthorized access.
- Passwords hashed with bcrypt — never stored in plain text
- Automatic account lockout after repeated failed attempts
- Idle session timeout and server-side session management
Organization-Level Data Isolation
Each organization's data is scoped at the query level. Users only ever see data belonging to their own organization.
- Every query filtered by your organization
- No cross-organization data leakage
- Separate user management per organization
Encryption in Transit
All data transmitted between your browser and Aliquora is encrypted using TLS, helping protect information as it moves across the network.
- TLS encryption for all connections
- Secure HTTPS endpoints
- Protection for data in transit
Data Ownership & Export
Your records are yours. Export your data at any time in CSV or PDF format to archive, review, or migrate it on your terms.
- CSV export for samples, results, and audit logs
- PDF export for Certificates of Analysis
- Download your data whenever you need it
Mapped to ALCOA+ data integrity principles
ALCOA+ is the data-integrity framework your auditors already know. Here's how Aliquora's controls line up with each principle.
Attributable
Every action and signature is tied to a named user account with a timestamp.
Legible
Records are stored as structured, human-readable data and exportable to CSV and PDF.
Contemporaneous
Actions are time-stamped when they happen and written to the audit trail in real time.
Original
Source records are retained; signed and verified records are protected from edits.
Accurate
Automatic out-of-spec checks and review/approval workflows guard data quality.
Complete · Consistent · Enduring · Available
The append-only audit trail, consistent data model, and on-demand export support the ALCOA+ extensions.
Supporting the controls behind 21 CFR Part 11
FDA 21 CFR Part 11 governs electronic records and electronic signatures. Aliquora provides the core technical controls the rule calls for, so you can build your compliant process on top of a system that's designed for it.
Want the full requirement-by-requirement mapping? Our 21 CFR Part 11 & ALCOA+ capability matrix lays it out, requirement by requirement — read it online or print it to PDF.
Read the capability matrix- Computer-generated, time-stamped audit trail of key actions
- Electronic signatures that capture identity, date/time, and meaning
- Each signature cryptographically bound to a snapshot of the signed record (tamper-evident)
- Password re-authentication at the point of signing
- Role-based authority checks enforced server-side
- Limiting system access to authorized individuals
- Human-readable and electronic copies of records for review and inspection
Compliance documents you can read today
No gated forms or "contact us to learn more." Read every document online, or print any of them to PDF for your audit file.
21 CFR Part 11 & ALCOA+ capability matrix
A requirement-by-requirement mapping of Aliquora's controls to Part 11 and ALCOA+.
ISO/IEC 17025 alignment guide
A clause-by-clause mapping to ISO/IEC 17025:2017 for testing labs.
Validation support pack (IQ / OQ / PQ)
Customer-executed validation protocol templates to support your computer-system validation.
Security & compliance overview
A concise packet summarizing every control for your security review.
Compliance roadmap
We believe in being precise about what exists today versus what's planned. No vague badges — just an honest picture.
Available today
- Tamper-evident electronic signatures (re-verifiable, bound to record snapshot)
- Password re-authentication for signing and for unlocking verified results
- Append-only, exportable audit trail (including data exports and result unlocks)
- Tamper-resistant signed/verified records
- Role-based access control & authority checks
- Account lockout, password hashing, session timeout
- Organization-level data isolation
- TLS encryption in transit
- Full data export (CSV / PDF)
Planned
- Multi-factor authentication (MFA)
- Encryption at rest
- SOC 2 examination
- Configurable data-retention controls
Shared responsibility & validation
Aliquora provides the technical controls described above. Compliance is a shared responsibility: certification, computer-system validation (IQ/OQ/PQ), standard operating procedures, user administration, and confirming the system meets your specific regulatory obligations remain the responsibility of your organization. Aliquora is not itself certified or accredited; we provide capabilities that support your compliance program. We're happy to support your validation effort — just ask.
Talk to us about your compliance requirements
Tell us about your lab and the standards you work under. We'll share our security & compliance packet — including the full 21 CFR Part 11 & ALCOA+ capability matrix — and answer your team's questions.
Contact us