Security & Trust

Built with the
same scrutiny as the audits.

ValiCore handles regulated lab data. Every architectural choice — encryption, isolation, access, hosting — is documented and held to the same standard your inspectors expect of you.

Controls

How we protect your data.

Encryption everywhere

AES-256 at rest on all customer data
TLS 1.2+ in transit (HSTS enforced)
bcrypt password hashing (cost factor 12)

Authentication & access

Per-organisation data isolation
Role-based access control (ADMIN / USER)
TOTP-based 2FA, mandatory for admins in Part-11 mode
Session revocation + active-session listing

Auditability

Immutable audit log on every mutating action
Before/after diff stored per change
Audit-trail export for inspectors at any time
21 CFR Part 11, Schedule M, ISO 15189 alignment

Infrastructure

Hosted on AWS Mumbai (ap-south-1)
Customer data does not leave India without consent
Daily encrypted backups, 30-day retention
Targeted 99.5% monthly uptime

Application hardening

Rate-limited public APIs
CSP, X-Content-Type-Options, X-Frame-Options
Server-side input validation (zod schemas)
Audit-logged secret rotation (API keys)

Operational practices

Critical alerts to admins via email
Background cron for status updates
Weekly compliance digest by email
Tested incident-response runbooks

Frameworks

Aligned with the standards you’re audited against.

Configure ValiCore per our published guidelines and the platform supports the record-keeping requirements of these frameworks out of the box.

21 CFR Part 11

Audit trails, e-signatures, access controls

Schedule M

India GMP record-keeping requirements

ISO 15189

Medical-lab quality system

ALCOA+

Data-integrity attributes by design

GAMP 5

Computer-system validation methodology

WHO-GMP

WHO Good Manufacturing Practice

Responsible Disclosure

Found a vulnerability?

We welcome reports from the security community. Email security@valicore.in with details and we will acknowledge within 2 business days. We commit to:

Triaging the report within 5 business days
Not pursuing legal action against good-faith researchers
Crediting reporters who consent to disclosure
Notifying you when a fix has shipped

security@valicore.in

For procurement questions or to request a sub-processor list:

Talk to our team

Security & Trust

Built with the
same scrutiny as the audits.

ValiCore handles regulated lab data. Every architectural choice — encryption, isolation, access, hosting — is documented and held to the same standard your inspectors expect of you.

Controls

How we protect your data.

Encryption everywhere

AES-256 at rest on all customer data
TLS 1.2+ in transit (HSTS enforced)
bcrypt password hashing (cost factor 12)

Authentication & access

Per-organisation data isolation
Role-based access control (ADMIN / USER)
TOTP-based 2FA, mandatory for admins in Part-11 mode
Session revocation + active-session listing

Auditability

Immutable audit log on every mutating action
Before/after diff stored per change
Audit-trail export for inspectors at any time
21 CFR Part 11, Schedule M, ISO 15189 alignment

Infrastructure

Hosted on AWS Mumbai (ap-south-1)
Customer data does not leave India without consent
Daily encrypted backups, 30-day retention
Targeted 99.5% monthly uptime

Application hardening

Rate-limited public APIs
CSP, X-Content-Type-Options, X-Frame-Options
Server-side input validation (zod schemas)
Audit-logged secret rotation (API keys)

Operational practices

Critical alerts to admins via email
Background cron for status updates
Weekly compliance digest by email
Tested incident-response runbooks

Frameworks

Aligned with the standards you’re audited against.

Configure ValiCore per our published guidelines and the platform supports the record-keeping requirements of these frameworks out of the box.

21 CFR Part 11

Audit trails, e-signatures, access controls

Schedule M

India GMP record-keeping requirements

ISO 15189

Medical-lab quality system

ALCOA+

Data-integrity attributes by design

GAMP 5

Computer-system validation methodology

WHO-GMP

WHO Good Manufacturing Practice

Responsible Disclosure

Found a vulnerability?

We welcome reports from the security community. Email security@valicore.in with details and we will acknowledge within 2 business days. We commit to:

Triaging the report within 5 business days
Not pursuing legal action against good-faith researchers
Crediting reporters who consent to disclosure
Notifying you when a fix has shipped

security@valicore.in

For procurement questions or to request a sub-processor list:

Talk to our team

Built with the same scrutiny as the audits.

How we protect your data.

Encryption everywhere

Authentication & access

Auditability

Infrastructure

Application hardening

Operational practices

Aligned with the standards you’re audited against.

Found a vulnerability?

Built with the same scrutiny as the audits.

How we protect your data.

Encryption everywhere

Authentication & access

Auditability

Infrastructure

Application hardening

Operational practices

Aligned with the standards you’re audited against.

Found a vulnerability?

Built with the
same scrutiny as the audits.

Built with the
same scrutiny as the audits.