Appearance
FAQ: Security
Security-related frequently asked questions for EaseLab users and administrators.
Is my patient data encrypted?
| Layer | Protection |
|---|---|
| In transit | HTTPS/TLS for all API communication |
| At rest | Depends on PostgreSQL and storage configuration by operator |
| Backups | Encrypted if S3/server encryption is configured |
Ask your platform operator about at-rest encryption policies.
How is tenant data isolated?
Each lab has a separate PostgreSQL database. Cross-tenant data access is architecturally prevented. See Data Isolation.
What authentication does EaseLab use?
JWT access tokens (15-minute lifetime) and HTTP-only refresh cookies (7 days). See Authentication.
Should I enable two-factor authentication?
Yes, for all administrators and owners. Optional but recommended for other staff. See 2FA.
Are passwords stored securely?
Passwords are hashed using industry-standard algorithms (ASP.NET Identity). Plain-text passwords are never stored.
Who can see my lab's data?
| Actor | Access |
|---|---|
| Your staff | Based on assigned roles |
| Platform support | Only via audited impersonation |
| Other labs | No access |
| Patients | Only their own reports (with access code) |
What is impersonation?
Platform support staff with permission can sign in as your tenant owner using a 2-minute one-time code. See Impersonation.
How do I report a security concern?
Contact your platform operator immediately. Do not post vulnerabilities publicly.
Is the public report lookup secure?
Patients need both invoice number and access code. Lookups are rate-limited. Failed attempts return generic errors to prevent enumeration.
What happens on logout?
The refresh token is revoked server-side and the cookie is cleared. Access token expires naturally.
Can I restrict which email domains register?
Platform admins configure registration email policy to block disposable emails or allow only whitelisted domains.
Are API keys for analyzers secure?
- Keys are shown once at device creation.
- Transmitted via HTTPS header
X-Analyzer-Key. - Revoke compromised keys immediately.