NextGenAMR — a product by Vanguard Biotech Systems
Security
This page summarises the current security approach for NextGenAMR and this website. Each control shows its status from the internal control register; controls that the evidence does not support are not claimed. Security controls are not a claim of clinical validation or regulatory conformity.
In development · Not for clinical use
In development. The E. coli engine is being built and will be evaluated internally under a pre-specified protocol. An independent external validation protocol has been drafted. No performance results have been published. Not for clinical use.
Current controls
Statuses follow the internal control register and use the same taxonomy as the rest of the site. Controls without evidence that supports a public statement are not claimed and are not listed. Statuses are shown as text, never colour alone.
Isolation & authorization
Environment separation
In developmentDevelopment, staging and production run in separate cloud accounts with independent data stores, storage and distributions. Code-level guards forbid development-only modes (demo seeds, mock runners, auto-trusted devices) from ever running in production and detect cross-environment resource mismatches.
Scope: Applies across the platform.
Data protection
Encryption in transit
In developmentPublic traffic is served over HTTPS only (HTTP is redirected), using a modern TLS profile (TLS 1.2 or higher) with a managed certificate, and HTTP Strict Transport Security is enforced in production.
Scope: Applies to the public website.
Secrets management
In developmentWorkload secrets are supplied from a managed secret store at start-up, never written to logs, and the service fails fast if a secret is missing or a placeholder. The repository carries automated secret scanning and pre-commit checks, and published artifacts contain no secrets.
Scope: Managed secret injection applies to staging and production workloads; rotation follows a documented procedure with preflight tooling.
Limitations
- Scheduled automatic secret rotation is procedure-driven, not yet a proven automated mechanism.
The website is not a data channel
Built (internal R&D)The public website and ordinary email are not authorised channels for samples, sequences, genomic files, sample identifiers or patient data. Any evaluation involving data is conducted through a channel and conditions agreed with VBS.
Scope: Applies to all public contact surfaces.
Operation
Backups & recovery
In developmentThe managed database has automated backups with a defined retention window and is not publicly accessible. Restore procedures are documented and periodically exercised with a non-destructive dry-run.
Scope: Applies to the managed database.
Limitations
- Restores are drilled with a dry-run, not continuously verified end-to-end.
Incident-response procedures
In developmentA maintained set of severity-tagged incident-response runbooks (pipeline, API, database, storage, secrets rotation, threat findings, deploy rollback), validated for structure in continuous integration, together with automated remediation for certain cloud threat findings.
Scope: Runbooks are documented and CI-validated; end-to-end incident exercises are pending.
Limitations
- Not yet exercise/tabletop-proven end to end.
Web security headers
Built (internal R&D)The public site sends hardening response headers — HTTP Strict Transport Security, anti-framing, no MIME sniffing and a prudent referrer policy — and the staging environment is marked non-indexable.
Scope: Applies to the public website.
Content Security Policy
In developmentA Content Security Policy restricts where scripts, styles, fonts, images and connections may load from. It is live in production with inline allowances: the framework's inline bootstrap script currently requires an inline-script allowance.
Scope: Applies to the public website.
Limitations
- Scripts and styles still allow inline content; a stricter, hash-based policy is not deployed.
What data the website handles
The public website and ordinary email are not authorised channels for samples, sequences, genomic files, sample identifiers or patient data. Any evaluation involving data uses a channel and conditions agreed with VBS.
Reporting a security issue
Security reports are currently received through the general Vanguard Biotech Systems contact address. This is the company's current contact channel, not a dedicated security operations team. To help us route it, please include “Security report” in the subject.
vanguardbiotechsystems@gmail.com
- Describe the issue, the observed impact and reproducible steps; contact details are optional.
- Please do not access, modify, delete or exfiltrate data, and do not run denial-of-service tests or social engineering.
- Please allow a reasonable review period before publishing any details.
This is not a paid bug-bounty programme; we do not currently offer rewards or a fixed response time.
See /.well-known/security.txt →Questions institutions ask
Can we send data through the website?
The public website and ordinary email are not authorised channels for samples, sequences, genomic files, sample identifiers or patient data. Any evaluation involving data uses a channel and conditions agreed with VBS.
Is security the same as clinical validation?
Security controls are not clinical validation, a medical-device conformity mark, or authorisation for diagnostic use.
What does provenance record?
Every processing batch carries a write-once record of what produced it. Model packages and result records will join the same chain once they exist.
How do we report a vulnerability?
Security reports are currently received through the general Vanguard Biotech Systems contact address. This is the company's current contact channel, not a dedicated security operations team. To help us route it, please include “Security report” in the subject.
Questions about security
Vanguard Biotech Systems does not currently make regulatory-authorisation or autonomous-clinical-use claims for NextGenAMR. Intended use and regulatory strategy will be assessed as the product evolves.
NextGenAMR is in development and is not intended for clinical use. It has no authorisation or declaration of conformity for clinical diagnostic use: no CE marking under the EU In Vitro Diagnostic Regulation (IVDR, Regulation (EU) 2017/746) and no FDA marketing authorisation. No ISO 13485 quality-management certification is claimed.