Trust & security

Every screen beyond the public pages requires an authenticated session. Accounts belong to an organisation and a site, and roles — operator, quality manager, director — determine what each person can configure. Role membership is held in a dedicated table and checked server-side, never in the browser.

Every table carrying customer data is protected by row-level security scoped to the signed-in user's organisation. A query from one organisation cannot return another organisation's rows, and models are trained only on the organisation's own history.

There is no write path from Assay to any control system. Assay cannot change a setpoint, start or stop equipment, or release product. The operator decides and acts; that boundary is architectural, not a setting.

Predictions, interventions and ledger entries are recorded with what was known at the time, who acted and what the laboratory later confirmed. Value entries reference the batch and intervention they came from, so any recovered-value figure can be traced back to a specific event.

A model that cannot beat the site's own historical baseline is not shown on the line. Model health is scored continuously; when accuracy degrades past its threshold the model is quarantined and the line falls back to no prediction rather than a wrong one. Out-of-distribution runs are flagged as such.

The application and database are hosted on managed cloud infrastructure with encryption in transit and at rest provided by the platform. Backups are managed by that platform.

We are responsible for the application, its access controls and the separation described above. Your organisation is responsible for who you invite, the accuracy of the data and cost parameters you upload, any webhook or alert destination you configure, and the decisions your team takes on the line.

If you believe you have found a security issue, contact the operator of this deployment through the route your organisation was given at onboarding, with enough detail to reproduce it. Please do not test against another organisation's data.