Data Privacy & Security

1.Introduction

At Vidialabs, we understand that your research data is sensitive and valuable. Vivgram protects it through encryption, tenant isolation, access controls, continuous security testing, and enterprise-grade cloud infrastructure. Detailed security architecture and implementation documentation is available to customers and qualified prospects under NDA — see Full Security Documentation below.

2.Data Protection at a Glance

2.1 Encryption

All customer data is encrypted both in transit and at rest using industry-standard protocols.

2.2 Enterprise-Grade Cloud Hosting

Vivgram runs on a leading hyperscale cloud infrastructure provider that holds SOC 2 Type II, SOC 3 Type II, CSA STAR Level 1, and GDPR compliance certifications with a published Data Processing Agreement. Production data is hosted in the United States by default.

Vivgram is cloud-only. Customer data is not stored on on-premises servers or on Vidialabs employee devices. The one exception on users' own devices: draft text in the optional IACUC protocol builder is saved in the user's own browser while they work.

2.3 Tenant Isolation

Vivgram uses a multi-tenant architecture with logical data isolation. Every record is tagged to a tenant, and every query is scoped to the authenticated user's organization, so users can only access data belonging to their own organization.

2.4 Access Control

• Passwords are stored as secure hashes.
• Optional multi-factor authentication (MFA).
• Role-based permissions grant each user only the access their role requires.
• All user actions are logged with a timestamp and the user who performed them, for audit purposes.
• Vidialabs staff have no access to a customer's account by default. Direct access requires the customer to add Vidialabs staff to its account, and our development team can access customer data in the back-end database only when the customer authorizes it for a specific support ticket.

2.5 Security Testing

• Every code change is automatically scanned for known vulnerabilities before it can be released.
• Software libraries are reviewed and updated every week.
• A comprehensive security audit of all Vivgram applications is performed every 6 months.

2.6 Data Retention & Deletion

We retain customer data for the duration of your service agreement. Upon termination or request, active data is deleted within 30 days and purged from backups within 90 days. A data export is available beforehand, and deletion confirmation is provided on request.

2.7 Incident Notification

3.Full Security Documentation

Detailed documentation — covering our security architecture, encryption and key management, network controls, monitoring and logging, tenant-isolation design, our software development and release process, and our shared-responsibility matrix, along with evidence of our hyperscale provider's SOC 2 Type II, SOC 3 Type II, and CSA STAR Level 1 posture — is available under NDA to customers and qualified prospects.

4.Contact Us

If you have questions about our data privacy and security practices, or to report a security concern: