Security

Last updated: 29 July 2026

This page describes how BatchPilot is built. Items marked "in production" depend on your live deployment. Have your security and compliance team review this before publishing, and do not claim certifications you have not obtained.

BatchPilot handles regulated manufacturing records, so security and data integrity are built into the product, not bolted on. Here is how it works.

Accounts and sign in

Every person has their own account. There are no shared logins. Passwords are stored only as a salted scrypt hash, never in readable form. Sessions use a strictly necessary, HTTP-only cookie with an expiry, so the session token is not readable by scripts in the browser.

Signing off a review requires the reviewer to re-enter their password at the moment of signing, so an electronic signature is tied to a verified person.

Roles and least privilege

Access is controlled by role, and each company configures what each role is allowed to do across a fixed set of capabilities (enter records, run the AI review, decide flags, sign off, manage deviations, manage the team). Every action is checked on the server, not just hidden in the interface.

Separation between companies

BatchPilot is multi-tenant. Each company's users, records, deviations, and audit trail are scoped to that company and checked on every request. One company cannot see or reach another company's data.

Audit trail and data integrity

Every meaningful action is written to an append-only audit trail. Each entry is linked to the previous one with a SHA-256 hash chain kept separately for each company, so altering an earlier entry breaks the chain and is detectable. Editing a batch record is a controlled event: it requires a reason, bumps the record's revision number, and is written to the audit trail with the fields that changed.

Encryption

In transit, all traffic uses HTTPS/TLS, including the connection to our AI provider. In production, data at rest is stored on encrypted infrastructure.

AI data handling

The AI provider's API key is held only on the server and is never sent to the browser. Record text is sent to the provider only to generate a review, over an encrypted connection, and the provider does not use API content to train its models. The AI is advisory: a qualified person makes every decision.

Hosting, backups, and availability

In production, BatchPilot runs on [hosting provider] in [region], with regular encrypted backups and a documented recovery process. [Describe your real hosting, backup, and disaster-recovery arrangements here.]

Regulatory alignment

BatchPilot is designed to support the expectations of 21 CFR Part 11 and EU GMP Annex 11 (unique accounts, electronic signatures, and a tamper-evident audit trail) and to help you meet data-protection obligations under the GDPR and CCPA/CPRA. Formal computer system validation and any certifications are completed per deployment and are a shared responsibility with your quality organization.

Reporting a vulnerability

If you believe you have found a security issue, please email [security@yourcompany.com]. We will acknowledge your report and work with you on a resolution. Please do not publicly disclose an issue until we have addressed it.

Your responsibilities

Keep credentials confidential, give each person their own account, grant only the permissions each role needs, and remove access promptly when someone leaves. Security is a shared effort.