DRAFT — before legal review. This text was drafted by the service team. It is not legal advice and it may change.

Security

Draft written on 2026-10-07. This page describes how StockVial protects your lab's data. Questions: info@bsi3q.com.

Lab separation

Every lab's data is separated from every other lab's by row-level security in the database. A person can read and change only the data of the lab they belong to.

Encryption

Data is encrypted in transit (HTTPS) and at rest by our infrastructure providers. The database runs in the United States (AWS US East, us-east-1).

Backups

The database is backed up every day by our database provider on its Pro plan.

Access control

Each person in a lab has a role: admin, approver or member. What a person may do, such as inviting members, approving purchases or changing settings, depends on the role. Receiving, use and disposal records cannot be edited or deleted; a mistake is corrected by a cancellation record, so the history stays complete.

Secrets

Keys and passwords of the service are kept in environment variables of the hosting platform, not in the code. Card details are handled by Stripe and are never stored by StockVial.

Reporting a vulnerability

If you find a security problem, please write to info@bsi3q.com with the details. Please do not access other people's data while testing, and give us a reasonable time to fix the problem before you share it.

What we do not have

StockVial does not currently hold a SOC 2 report or an ISO 27001 certificate. We do not claim compliance with HIPAA or GDPR.