MeristemLab

Security

Last updated 1 October 2026

This page describes, plainly, what we do to protect the data in MeristemLab. It is a description of our current practice, not a certification.

Where your data lives

  • Supabase Inc: Database, authentication and application hosting, hosted in United States (AWS us-east-1).
  • Vercel Inc: Web hosting, serverless functions and cookieless web analytics, hosted in United States (iad1).

Encryption

  • Every connection to the Service uses HTTPS (TLS). We send HTTP Strict Transport Security headers so browsers never fall back to plain HTTP.
  • Stored data and backups are encrypted at rest by our database host.
  • Passwords are never stored; only a salted hash held by our authentication provider.

Keeping labs apart

  • Every record belongs to one lab. Row-level security policies in the database only return rows for the lab the signed-in user belongs to, and the database itself rejects attempts to move a user or a record between labs.
  • Within a lab, owners and admins control who is a member and what role they hold. Removed members lose access immediately.
  • Support staff access to a lab is limited to named people, used only for a support request or incident, and recorded in that lab’s audit log.

Audit trail

Key changes to cultures, mother plants, customers, orders, contamination events and team membership are written to an append-only audit log with the user and time. Lab members can read their lab’s log but cannot edit or delete it.

Backups

Our database host takes regular automated backups. Backups are retained and expire according to the periods in our Privacy Policy. Lab admins can also export their records from Settings at any time.

Incident response

If we detect or are told of a security incident we will contain it, assess it within 30 days, and notify affected labs and the Office of the Australian Information Commissioner where the Notifiable Data Breaches scheme requires it.

Reporting a vulnerability

If you find a security problem, please email hello@meristemlab.com with enough detail for us to reproduce it. We will acknowledge your report and keep you informed. Please do not access data that is not yours while testing.

What we do not have yet

MeristemLab does not currently hold a SOC 2 report or ISO 27001 certification, and does not offer two-factor authentication or single sign-on. We will update this page as that changes.