Security
Where the records are, who can see them, and what leaves the country.
Every service that touches data
The register, as it stands.
Not a paragraph about residency. Each entry names the provider, what it does, what it holds and where. The same list is the privacy policy's residency section, and the application refuses to claim residency in writing until a check reports it true.
| Provider | Purpose | Location | Laboratory records | Offshore |
|---|---|---|---|---|
| Supabase | Database, file storage and sign-in. | Sydney, Australia (ap-southeast-2). Supabase Inc is incorporated in the United States. | Yes | No |
| AWS App Runner | Runs the application, and the public marketing website. | Sydney, Australia (ap-southeast-2). | No | No |
| Hostinger | The mailbox this business receives mail at. | Asia. Hostinger has no Australian data centre; its Sydney presence is a cache for static files. | No | Yes |
| SMTP2GO | Delivers recall notices, certificates, quotes and invoices. | Sydney, Australia. SMTP2GO Ltd is incorporated in New Zealand. | No | No |
| Stripe | Takes the laboratory’s subscription payment, and card payments from its customers. | United States and Australia. | No | Yes |
The full entries, including what each provider handles and why, are on the application's sub-processor page, which is the document of record.
How it is built
The controls, by name.
How is one laboratory kept from another?
Row-level security is forced on every table in the database, and a restrictive policy on each refuses a session that carries no laboratory. Permissive rules cannot add up to an exception because a restrictive one subtracts from all of them. A battery of live isolation checks runs against the production schema on every release, and multi-tenancy was proved against a second live laboratory before the first paid.
Who at CalibraWorks can see what?
An operator must never read a laboratory's customers. The two tables that would allow it — the mail log, which holds addresses, and the audit log, which holds the before and after of every record — are exposed to the operator console as aggregates only, and a check in the build aborts the release if a later version returns those columns. That is a policy in the database, not a promise in a document.
What about staff sign-in?
A second factor is optional to enrol and mandatory to use. Once a factor exists, every tenant-scoped table refuses a password-only session, and no setting can reach that. Whether to require enrolment for all staff is the laboratory's decision about its own records, under ISO/IEC 17025 §7.11. The operator console is always second-factor, because one session there reads every laboratory.
How is a certificate kept honest?
Every number on a certificate comes from a deterministic engine; no language model computes a result, sets an uncertainty, decides pass or fail, or issues a document. The engine reproduces byte-for-byte from the stored inputs, and issue recomputes and refuses on a mismatch. The rendered PDF is stored in an immutable bucket with its SHA-256 in the database. An amendment is a new linked version and the original is kept, as ISO/IEC 17025 §7.8.8 requires.
Can a certificate be enumerated?
No. Public verification tokens are random, never sequential — a sequential number would let anyone walk every certificate ever issued. Verification is served without a login and is never switched off for non-payment.
Backups?
Taken and restored, on a schedule, with the restore rehearsed rather than assumed; the runbook is written and the restore has been run. A backup that has never been restored is a hope.
CalibraWorks holds laboratory records in Sydney, Australia, in the AWS ap-southeast-2 region, and the privacy policy's residency section is generated from the sub-processor register rather than written.
No language model computes a calibration result, sets an uncertainty, decides pass or fail, or issues a certificate. One model reads an incoming instrument list into proposals a person confirms, and it writes to no table.
What procurement asks
- Where is my laboratory's data stored?
- Supabase — Sydney, Australia (ap-southeast-2). Supabase Inc is incorporated in the United States.. Laboratory records are held in Sydney, in the AWS ap-southeast-2 region. The list on this page is generated from the same register the privacy policy is generated from, so a residency claim here cannot outrun the one in the policy.
- What leaves Australia?
- Hostinger: The mailbox this business receives mail at. Stripe: Takes the laboratory’s subscription payment, and card payments from its customers. Nothing from a laboratory's records goes to either. The register names them because a residency claim that quietly covers only the database is a misleading one.
- Can your staff read my customers' data?
- The operator console is aggregate-only over the two tables that hold customer details — email addresses in the mail log and the before-and-after of every record in the audit log — and a check in the build aborts the release if a later version returns those columns. The operator can see that a laboratory sent forty recalls last night; not to whom.
- How is one laboratory kept from seeing another?
- Row-level security is forced on every table, with a restrictive policy on each that refuses a session without a tenant, and a battery of live isolation checks runs against the production schema on every release. Multi-tenancy was proved against a second live laboratory before the first paid.
- Is a second factor required?
- Optional to enrol and mandatory to use: once a staff member holds a factor, every tenant-scoped table refuses a password-only session, and no setting can reach that. Whether to require enrolment is the laboratory's own risk decision about its own records. The operator console is always second-factor.
- What does a certificate's integrity rest on?
- Each certificate is rendered deterministically — no headless browser, byte-reproducible — and stored in an immutable bucket with its SHA-256 recorded in the database. Issue recomputes the result from the stored inputs and refuses on a mismatch. Amendment creates a new linked version; the original is retained.
What happens to the records if the vendor stops trading is its own page: data ownership.
Start free. Thirty days, everything included.
No card. Nothing is deleted when a trial ends — the records are yours and stay readable.