Trust

Security Notice

Effective date: February 11, 2026Last updated: February 11, 2026

LabFoundersHQ takes the security of your account and business information seriously. This page summarizes the technical and organizational safeguards we have in place. Security is a shared responsibility — please review the customer-side responsibilities near the bottom of this page.

1. Our Commitment

We are committed to protecting the confidentiality, integrity, and availability of the information you entrust to us. Our engineering team continuously improves our security posture as the platform evolves.

2. Account Authentication

Access to the platform requires an authenticated session. Sessions are established through secure sign-in flows and time-limited tokens. Password reset requires a verified email address.

3. Password Hashing and Password Security

Passwords are hashed using industry-standard one-way hashing before being stored. LabFoundersHQ staff cannot see your plaintext password.

4. Role-Based Access Control (RBAC)

Every action inside the platform is gated by a role and, where applicable, a subscription entitlement. Founders, admins, clinicians, and staff each have a distinct access surface.

5. Tenant Isolation

Data is scoped by tenant (owning user) at every read and write. Users cannot view or modify data belonging to another tenant.

6. Administrative Access Restrictions

Administrative access to production systems is limited to authorized personnel and used only for maintenance, support, or incident response.

7. Secure Payment Processing via Stripe

All payment processing is performed by Stripe. Card numbers, CVV codes, and full payment details are never transmitted to or stored on LabFoundersHQ servers.

8. Audit Logging

Sensitive actions such as sign-in events, subscription changes, role changes, and administrative operations are recorded to an audit trail for review and incident response.

9. Production Monitoring

We monitor production services for availability, performance anomalies, and error rates. Alerts route to on-call engineering for triage.

10. Email Delivery via Resend

Transactional email is delivered through Resend using authenticated sending domains. Only the recipient address and message content necessary for delivery are shared.

11. Data Backups and Availability

The platform runs on managed cloud infrastructure that provides routine data-durability protections. We do not currently advertise a specific recovery-time or recovery-point objective publicly.

12. Customer Responsibilities

Use a strong, unique password and keep it confidential.
Protect the device you sign in from and lock it when idle.
Do not share your account credentials with others.
Report suspected unauthorized access immediately.

13. Reporting a Security Issue

If you believe you have discovered a security issue, please contact lfhq.support@gmail.com with a detailed description. Do not publicly disclose the issue until our team has had a reasonable opportunity to investigate.

14. What We Don't Claim

LabFoundersHQ does not currently hold SOC 2, HIPAA, or ISO 27001 certifications, and we do not represent that the platform is formally accredited by any laboratory or regulatory body. We do not guarantee absolute security, and we do not represent that any system is impenetrable.

15. Contact

Contact: lfhq.support@gmail.com