— Trust · Security →
Designed into the schema, not bolted on after.
What Holonyx enforces at the API layer for every module, in plain terms. We do not claim certifications we do not hold — ask for our current questionnaire responses and validation evidence.
Authentication
Password login with JWT access and refresh tokens, plus SSO through Okta, Microsoft or generic SAML. MFA status is visible per user, and API keys are audited and revocable.
Role-based access
Thirteen system roles — from Scientist and QA Reviewer to Mfg Operator and Regulatory Affairs — with a per-module matrix of read, write, edit, delete, approve, export and admin.
Enforced on the server
Permissions are checked at the API route, not just hidden in the interface. A viewer-only auditor and an operator see genuinely different surfaces.
Organization isolation
One shared stack with organization-scoped data. Every audit chain, configuration and record belongs to exactly one organization.
Tamper-evident history
Every create, update, delete, sign, approve and export is a hash-chained audit event with user, role, IP and session. A Chain Integrity check recomputes it on demand.
Sessions and recovery
Sessions can be revoked; the container stack supports volume and online graph backup, and a full-graph export for archival.
Roles & policies
A permission matrix per module — for every role.
System roles cover the lab, the floor and quality; custom roles can be added. The matrix is the effective permission set, and system-admin bypass is explicit and visible.
Users
Roles, and a record of every login and change.
Users carry a role, status, MFA flag and last-login time. Invitations, suspension and role changes are themselves audited.
Audit trail
Append-only, hash-chained, verifiable.
Each event records sequence, UTC time, user and role, IP, session, module, record, field, old and new value, regulation citation and reason. Each entry’s hash includes the previous entry’s, so retroactive change is detectable.
Send us your security questionnaire.
We will answer it against the running platform, control by control.