Security Overview

EaseLab is a multi-tenant SaaS platform. Security is built into authentication, authorization, tenant isolation, and operational controls at every layer.

Security pillars

Pillar	Description	Learn more
Authentication	JWT access tokens, HTTP-only refresh cookies, email verification	Login & Registration
Two-factor auth	TOTP and recovery codes for staff accounts	2FA
RBAC	Tenant roles, platform admin roles, fine-grained permissions	RBAC
Data isolation	Separate PostgreSQL database per tenant	Data Isolation

Who protects what?

flowchart TB
  subgraph Platform
    PA[Platform Admin Portal]
    PDB[(Platform DB)]
  end
  subgraph Tenant
    TP[Tenant Portal]
    TDB[(Tenant DB)]
  end
  PA --> PDB
  TP --> TDB
  PDB -. tenant metadata .-> TDB

• Platform operators manage tenants, billing, backups, and CRM through the admin portal with platform-scoped permissions.
• Lab staff access only their tenant's data through the tenant portal, governed by roles and permissions.
• Patients use anonymous public endpoints with rate limiting and access codes — no login required.

Transport and session security

Control	Behavior
HTTPS	Required in production; refresh cookies use Secure flag
Access token lifetime	15 minutes (configurable via Jwt:AccessTokenMinutes)
Refresh token	7-day HTTP-only cookie; rotated on each refresh
Rate limiting	Applied to login, registration, password reset, and public report lookup
CORS	Restricted to configured frontend origins

Account lifecycle controls

• Email verification — required before first sign-in for self-registered labs (unless platform admin).
• Tenant lock — unpaid or expired subscriptions enter read-only mode; mutations return 403 with TENANT_READONLY.
• Suspended tenants — login and refresh are blocked with a clear message.
• Impersonation — platform admins can sign in as a tenant owner via short-lived codes; see Impersonation.

Sensitive operations

Operation	Who can perform it
Restore platform backup	Platform admin with platform.backups.manage
Restore tenant backup	Tenant owner only
Change payment account	Platform admin with billing permission
Manage staff roles	Tenant admin or user with roles.* permissions

Related documentation

• API Authentication — JWT claims, endpoints, and cookie behavior
• Platform Administration — tenant lock, provisioning, backups
• FAQ: Security — common security questions
• Troubleshooting: Login — access issues

Reporting security issues

If you discover a vulnerability, contact your platform operator or EaseLab support directly. Do not disclose publicly until a fix is available.