Security

Where your data lives

• In the United States. The database and sync server run on servers we rent from Hetzner; the app runs on Cloudflare's network.
• The database isn't reachable from the internet. The app reaches it only through an encrypted Cloudflare tunnel that needs a service token.
• Every company that processes data for us, and what it sees, is on the subprocessors page. We update it before adding one.

Encryption

• Every connection uses HTTPS (TLS), including live sync, and browsers are told never to use plain HTTP.
• Passwords are stored only as a one-way hash, never in a form we could read.
• Backups are encrypted on the server before they leave it, with a key kept offline.

Who can see your lab's records

• Only the members of your workspace. Each has a role: owner, manager, worker or viewer. Viewers can only read, and a manager has to approve them.
• Our server checks access on every request and every change, from the signed-in account, never from what the browser says.
• Workspaces are separated in the database: every record belongs to one workspace and every query is limited to it.
• On our side, one person has admin access. Admin access requires two-step sign-in, and every admin action is recorded. We look at a lab's records only to help when you ask us to, or to keep the service working and secure.

Signing in

• Passwords must be at least 10 characters. You can also sign in with an emailed link.
• Two-step sign-in with an authenticator app, with backup codes.
• Sign-in attempts are rate-limited by email address and by network, so passwords can't be guessed by brute force.
• Resetting a password signs out every device.
• Signing out deletes the records saved for offline use from that device.

A history of every change

Every change to your lab's records is kept: who made it, when, on which device, and the values before and after. Managers can search it by mouse, cage, person or date and download it, for an inspection or to see what happened to an animal. The history is written with the change itself, so neither can be saved without the other.

Backups

The database is backed up every night, encrypted, to separate storage (Cloudflare R2), and each backup is kept for 35 days. Restoring from them is tested. At worst, the last day of changes could be lost.

Monitoring

• Uptime is checked around the clock, including the nightly backup and the reminder jobs. Anyone can see it on the status page.
• Errors are reported to us when something breaks, without names, emails, IP addresses, cookies or anything you entered.
• Every change to CageCard is checked automatically before it's released.

Your data, yours to take

• A workspace's owner can download all of its data as spreadsheets at any time, from Settings.
• Deleting a workspace removes it from the live database within 30 days, and from backups as they expire, within a further 35 days.
• Anyone can delete their own account. The lab's records stay with the lab, and the person's name in the history is replaced with "Former member".
• We don't sell your data, there are no advertising or analytics trackers, and we don't train AI on it.

If something goes wrong

If a security incident affects your lab's data, we'll tell the workspace's owners and managers within 72 hours of finding out: what happened, what data was involved, and what we're doing about it. We'll keep you updated until it's resolved.

Reporting a vulnerability

If you think you've found a security problem in CageCard, please email security@cagecard.app with the details. We'll reply within 3 working days and let you know when it's fixed. Please don't access other people's data or disrupt the service while testing; we won't take action against good-faith research that follows this. Also in security.txt.

Security reviews and questionnaires

If your institution needs a security questionnaire (such as a HECVAT) or a data processing agreement, email security@cagecard.app and we'll fill it in.

Not yet

So you know where things stand:

• CageCard isn't SOC 2 certified. We'll pursue it when institutions need it.
• Labs can't yet require two-step sign-in for all their members, and passkeys aren't supported yet. Both are planned.
• Data is stored only in the US for now. A European data region is planned.
• CageCard isn't validated for 21 CFR Part 11 or GLP studies.