Security at IntuitionLabs

All client-facing connections use TLS 1.2 or higher with modern cipher suites, enforced at the edge by Cloudflare and at the origin by our application platforms. Data at rest is encrypted using provider-managed keys (AES-256 equivalent) on AWS S3, RDS, and Google Cloud Storage. Secrets are stored in dedicated secret managers (AWS Secrets Manager, Google Secret Manager, or platform-native equivalents) — never in source code, environment dumps, or shared documents. HSTS, secure cookies, and a strict Content Security Policy are enabled on public properties.

Access to production systems and client data is limited to engineers assigned to the engagement, is granted on the principle of least privilege, and is revoked on role change or engagement close. Multi-factor authentication is required for every identity provider, cloud console, source repository, and production jump host. Production access is logged and auditable. Shared accounts are prohibited.

We maintain an inventory of first- and third-party components and monitor for advisories via provider feeds, GitHub Dependabot, and NVD subscriptions. Critical and high-severity vulnerabilities are triaged within defined SLAs and patched or mitigated on documented timelines. Static application security testing runs on every pull request; dependency scanning runs on every build. Internet-facing services receive periodic external review.

Yes. Our SDLC follows the principles of NIST SSDF (SP 800-218) and OWASP ASVS for application security verification. Every change goes through peer code review, automated testing, and a CI/CD pipeline with mandatory controls before deployment. Infrastructure-as-code is version controlled and reviewed the same way as application code. For regulated-system work we layer GAMP 5 lifecycle controls on top of this baseline.

Application code is written against the OWASP Top 10 as a floor. We use parameterized queries and ORM-level protections against injection, output encoding and CSP against XSS, anti-CSRF tokens, short-lived JWT or session tokens with rotation, rate limiting at the edge, and input validation at the API boundary. Dependencies are scanned for known CVEs on every build.

Production environments are logically and network-isolated from development and staging. Private workloads live in VPCs with no direct public egress where feasible. Public surface is limited to documented endpoints fronted by Cloudflare's enterprise edge, which provides WAF, DDoS mitigation, and bot management. Inter-service calls use authenticated, TLS-encrypted connections; secrets never flow through client-side code.

We centralize application logs, platform logs, and access logs. Security-relevant events — authentication, privilege changes, admin actions, deploys, configuration changes — are captured with sufficient context for forensic review. Retention periods meet the longer of client contractual requirements and regulatory obligations. Alerting is tuned to reduce fatigue while still surfacing anomalies in authentication, egress, and data-access patterns.

Our incident response process defines severity tiers, an on-call rotation, an escalation chain, and client-notification timelines. For confirmed security incidents affecting client data we notify the client within the contractually agreed window, provide preliminary findings, and follow up with a full root cause analysis and corrective action plan. We retain runbooks for common incident categories (credential compromise, data exposure, availability event, supply chain compromise) and review them at least annually.

Email [email protected] with a description of the issue and reproduction steps. We acknowledge every report within one business day and follow a coordinated-disclosure process aligned with ISO/IEC 29147. We commit to keeping reporters informed on triage, remediation, and any advisory, and to crediting researchers who wish to be credited. We ask researchers to act in good faith, avoid privacy violations and service disruption, and give us reasonable time to remediate before any public disclosure.

Yes. IntuitionLabs maintains Errors and Omissions (professional liability), commercial general liability, and cyber liability coverage appropriate for life sciences consulting engagements. Certificates of insurance and coverage limits can be provided under NDA as part of vendor onboarding.