Security & SOC 2 Readiness
FlaskTrack maintains a formal security and control program aligned with the AICPA Trust Services Criteria and is preparing for an independent SOC 2 examination.
Our program covers the systems, people, policies, and operational controls used to develop, provide, protect, monitor, and recover the FlaskTrack platform.
Security assurance requires more than product features. Santurce Software has established a documented control framework specifically covering FlaskTrack's hosted platform and the supporting operations used to deliver it.
Where We Are in the SOC 2 Process
Our SOC 2 program is active and being operated today. It defines how controls are assigned, performed, reviewed, evidenced, tested, and improved across the FlaskTrack service.
| Program milestone | Status |
|---|---|
| System and control scope | Established |
| Policies and control framework | Established |
| Operational evidence collection | In progress |
| Readiness testing and remediation | In progress |
| Independent SOC 2 examination | Planned |
Program components
- Defined SOC 2 system scope and organizational responsibilities
- Controls mapped to the AICPA Trust Services Criteria
- Approved security and operational policies
- Formal risk, vendor, access, incident, asset, and change-management processes
- Evidence collection and recurring control-review schedules
- Incident-response, backup-restoration, and business-continuity exercises
- Audit-readiness workpapers and exception-management procedures
- Preparation for examination by an independent CPA firm
Security Across the Full FlaskTrack Service
The program extends beyond the application interface. It addresses how Santurce Software develops, deploys, operates, monitors, supports, and recovers FlaskTrack.
Identity and access control
Unique accounts, role-based authorization, multifactor authentication, privileged-access controls, access reviews, and organization-level isolation.
Secure development
Reviewed changes, automated testing, controlled deployment, vulnerability management, dependency monitoring, and additional review for sensitive changes.
Laboratory data integrity
Versioned records, authorization boundaries, approvals, audit trails, record history, and controls designed to protect laboratory operations.
Infrastructure security
Restricted production access, encrypted communications, security logging, monitoring, patching, secret management, and protected storage.
Incident response
Defined escalation, containment, investigation, recovery, communication, corrective-action, and post-incident procedures.
Backup and recovery
Automated protected backups, recovery procedures, restoration testing, continuity planning, and documented recovery objectives.
Vendor oversight
Risk-based assessment and review of infrastructure providers, subprocessors, AI providers, and other services that may affect FlaskTrack.
Continuous evidence
Scheduled access reviews, change records, vulnerability reports, alert investigations, recovery tests, vendor assessments, and control exceptions.
Controls for Modern Laboratory Infrastructure
Our security program accounts for the complete FlaskTrack environment rather than relying on generic SaaS statements. Its scope includes:
- Multi-tenant laboratory records and organization isolation
- Samples, batches, workflows, protocols, inventory, and files
- Audit trails, reviews, approvals, and validation records
- Instrument agents, connectors, ingestion, and result processing
- Python and R data-pipeline execution
- Reporting, data-lake storage, and analytical outputs
- API keys, API access, MCP tools, and AI-assisted workflows
- Molecular Studio records and sequence versioning
- Customer-configured AI providers and bring-your-own credentials
SOC 2 Complements Laboratory Validation
SOC 2 evaluates controls related to the security and operation of a service organization. It is distinct from 21 CFR Part 11, applicable GxP requirements, ALCOA+ data-integrity principles, and a customer's responsibility to validate FlaskTrack for its intended use.
- The SOC 2 program governs organizational and operational controls.
- FlaskTrack's compliance features support controlled laboratory records and workflows.
- Vendor documentation supports customer qualification and validation activities.
- Customers retain responsibility for configuration, procedures, intended-use validation, and regulated operation.
Learn more about FlaskTrack's technical controls and vendor-supporting documentation on our laboratory compliance page.
Clear About Our Current Status
FlaskTrack has not yet received an independent SOC 2 report. Our readiness program is active, documented, and being operated in preparation for examination.
We will update this page as material milestones are completed. Once an independent report is issued, eligible customers and prospects will be able to request it under appropriate confidentiality terms.
Need to Evaluate FlaskTrack's Security?
Prospective customers can request available security documentation, discuss deployment requirements, submit a security questionnaire, or review how FlaskTrack fits within their vendor-qualification process.