Security and compliance
What I send when a security questionnaire arrives. No generic statements — the concrete mechanisms behind each application.
Where the approach comes from
The applications in StarHub are built to the practices of regulated software: medical devices under IEC 62304, clinical systems under GxP and FDA 21 CFR Part 11. In those domains an incomplete audit trail is not a medium-priority bug — it blocks release. The same requirements underpin every product here, including where regulation would not demand them.
-
Tenant data isolation
Each company's data is separated at query level, not by a filter applied in the interface. A guessed or tampered identifier does not open another tenant's data, because the filter cannot be bypassed from outside the data-access layer.
-
Field-level encryption
National IDs, medical data and salaries are encrypted with AES-256-GCM using per-tenant keys — on top of TLS in transit and disk encryption. A compromised backup does not expose content, and one tenant's keys do not decrypt another's data.
-
An audit trail that survives an audit
Who, what, when and from which address, in a form the application cannot rewrite. This is the FDA 21 CFR Part 11 requirement for regulated systems, applied here by default rather than as an option to switch on.
-
Role-based rights, enforced server-side
Roles are hierarchical and checked on the server for every request. Hiding a button in the interface is not a security measure; access is refused where the decision is actually made.
-
Compliance built into the workflow
REGES-Online for contracts, e-Factura for invoicing, GDPR for personal data. These are steps in the normal working process, not separate modules someone has to remember to run.
-
Hosting and continuity
Infrastructure with backups verified by restore, not merely scheduled. We document storage location, retention period and recovery procedure for each application individually.
Got a security questionnaire?
Send it over and we will fill it in with concrete technical detail rather than reassuring phrasing.
Contact