Security and personal data

Passwords, lockout, sessions, where data is stored.

• Passwords are stored only as hashes; minimum length is 10 characters.
• After 8 failed attempts sign-in is blocked for 15 minutes.
• All forms are protected against request forgery (CSRF); the browser is not allowed to load third-party scripts.
• “Sign out on all devices” ends every session.
• The audit trail is append-only and hash-chained; integrity is checked every night.
• The database is backed up every night and backups are kept for 14 days.

Personal data

This installation keeps data on a server in Russia. The portal sends no data to third-party services: fonts, scripts and styles are served by the portal itself. See Personal data.

Honest status. This is a test, non-commercial installation. We do not claim full compliance with 21 CFR Part 11, GCP or data protection laws: validation and documents come before any work with real patients.