Trust
Security, architecture, and compliance posture
Tenant isolation
Schema-per-tenant PostgreSQL isolation — each tenant’s data lives in its own database schema, not a shared table filtered by a tenant column. Tenant binding is enforced at the request boundary through validated identity claims, before any query executes.
Access control
A single role-based access engine evaluates every request against your configured rule tree. Rules are defined per object type and can reflect your org hierarchy. Administrators can simulate any user’s effective access before publishing a rule — and simulation and enforcement run the same evaluation path.
Audit trail and electronic signatures
Record changes are captured immutably: who, what, when, previous and new value. Approval steps can require re-authentication and captured intent. Audit records are queryable and exportable as part of a document’s compliance package.
Data protection
Encryption in transit and at rest. Tokens held in httpOnly cookies rather than browser-accessible storage. Storage abstracted behind a service layer with access mediated by the permission engine.
Compliance posture — current status
| Area | Status |
|---|---|
| 21 CFR Part 11 — technical controls (audit trail, e-signature, access control) | Implemented — architected to support your Part 11 requirements |
| Computer system validation (IQ/OQ/PQ) | Delivered as a joint activity during implementation |
| SOC 2 Type II | Planned |
| ISO 27001 | Planned |
| GDPR / DPA | Planned — DPA draft available on request |
| Data residency options | Planned |
ColabFlo provides the technical controls that support your compliance program. Validation for intended use, and compliance itself, remain your organization’s responsibility — as they do with any system. We support that work; we don’t claim to replace it.