Skip to content
MDARIXProduct intelligence
Trust

Security at MDARIX

How MDARIX protects the quality, complaint and supplier records you investigate. MDARIX does not hold ISO 27001 or SOC 2 certification yet and is not a validated (GxP) system; we are glad to answer security questionnaires for a pilot.

Your data stays in your organization

  • Every organization's records are separated in the database by row-level security, so one customer's queries cannot read another's data.
  • Each person sees only what their role allows, and administrators manage access for their own organization.

Signing in

  • Passwords are at least 12 characters, checked against known breached passwords, and stored only as salted scrypt hashes.
  • Authenticator-app two-factor sign-in (MFA). Single sign-on (OIDC/SAML) is planned and not offered yet.
  • Repeated failed sign-ins are slowed down and then locked; sessions end after 30 minutes without activity.
  • Changing or resetting a password signs out every other session.

Data in transit and at rest

  • All traffic uses TLS, including the connection to the database.
  • Authenticator secrets and connector credentials are encrypted before they are stored.
  • Every file MDARIX stores, such as evidence attachments, is scanned for malware before it is stored, and files over the size limit are refused. Imported CSV and Excel files are read as data only and are not stored; workbooks with macros are refused.
  • During the validation phase the database runs on MDARIX's own server in Mumbai. It is backed up every day: an encrypted copy goes to Delhi, and a daily snapshot of the server's disk is kept in Mumbai. Restoring follows a written, rehearsed procedure.

Accountability

  • An append-only audit trail records who did what and when; each event is hash-chained to the one before it and verified daily, so any change to history is detected. Electronic signatures record the signer, meaning and time.
  • AI suggestions are advisory: they show the evidence they used, flag what could not be verified, and a person makes every decision. AI is off until an organization's administrator switches it on, and it stays off in free trials during the product validation phase.
  • In production, AI processing uses only providers under a contract that forbids training on your data, or models we host ourselves.

Reporting a security issue

Please use the contact page to reach us with the details.