Security and deployment

Credential authentication with a password-strength policy and hashed passwords. Time-based one-time-password (TOTP) multi-factor with single-use recovery codes, per-account lockout after repeated failures, and server-enforced step-up re-authentication for sensitive actions.

Scope: Multi-factor is enforced for privileged (administrative) roles and can be required per institution; it is available and enrollable for all users, but is not globally forced on every account.

Short-lived access tokens with rotating refresh tokens and server-side revocation: an administrative action (suspension, device revocation, institution block, logout-all) invalidates live sessions on the next request without waiting for expiry. Refresh-token reuse is detected and revokes the token family.

Scope: Applies to all authenticated sessions.

New devices require explicit administrative approval before a session is issued, and can be revoked at any time (revocation ends sessions and is audited). Devices can prove possession of a private key at login, with optional mutual-TLS; binding strength is graded honestly, and mobile companions receive a scoped, read-only session.

Scope: Cryptographic device-proof at login is supported and configurable per deployment tier; it is not enabled by default in every tier.

Authorization is enforced server-side as permission checks on each route — not by hiding interface elements. A closed role-to-permission model applies least privilege, institution/tenant data is isolated at the data and permission layer, and access denials are logged. Cross-tenant access by platform or auditor roles is explicitly recorded in the audit trail.

Scope: Roles include lab operator, authorized reviewer, institutional administrator and read-only auditor.

Development, staging and production run in separate cloud accounts with independent data stores, storage and distributions. Code-level guards forbid development-only modes (demo seeds, mock runners, auto-trusted devices) from ever running in production and detect cross-environment resource mismatches.

Scope: Applies across the platform.

Public traffic is served over HTTPS only (HTTP is redirected), using a modern TLS profile (TLS 1.2 or higher) with a managed certificate, and HTTP Strict Transport Security is enforced in production.

Scope: Applies to the public site and the application API.

Application data stores and object storage are encrypted at rest with managed keys, the database is encrypted, and server-side key material is held in a managed key or secret store — never in plaintext on disk or in browser storage.

Scope: Applies to managed application data and object storage.

Storage buckets block all public access and are reachable only through the content delivery layer with an origin access control; the database is not publicly accessible. Object storage is never browsable from the internet.

Scope: Applies to web and application storage.

Workload secrets are supplied from a managed secret store at start-up, never written to logs, and the service fails fast if a secret is missing or a placeholder. The repository carries automated secret scanning and pre-commit checks, and published artifacts contain no secrets.

Scope: Managed secret injection applies to staging and production workloads; rotation follows a documented procedure with preflight tooling.

The public website and ordinary email are not authorised channels for samples, sequences, genomic files, sample identifiers or patient data. Any evaluation involving data is conducted through a channel and conditions agreed with VBS.

Scope: Applies to all public contact surfaces.

Each run preserves the technical context needed for review and reproducibility: a run identifier and timestamps, environment and pipeline/app version, container image digest, workflow hashes, result-contract and database/reference versions, input and output artifact hashes and status, the initiating actor and device, execution status and warnings, and an explicit register of any field that could not be determined — recorded as missing, never fabricated.

Scope: Applies to every analysis run.

Security-relevant events pass through a single validated writer and are recorded as an append-only, per-tenant cryptographic hash-chain, so any modification, deletion or reordering is detectable by an independent verifier. Event types and metadata are restricted to a non-personal allow-list, and reads are limited by role.

Scope: Applies to security-relevant events.

Health and liveness endpoints, structured request-correlated logging with a role-gated internal view that redacts personal data, and a catalogue of technical alerts mapped to on-call playbooks.

Scope: Technical monitoring; alert-driven with on-call runbooks.

The managed database has automated backups with a defined retention window and is not publicly accessible. Restore procedures are documented and periodically exercised with a non-destructive dry-run.

Scope: The backup mechanism is implemented; continuous, signed-off restore verification is still being validated.

A maintained set of severity-tagged incident-response runbooks (pipeline, API, database, storage, secrets rotation, threat findings, deploy rollback), validated for structure in continuous integration, together with automated remediation for certain cloud threat findings.

Scope: Runbooks are documented and CI-validated; end-to-end incident exercises are pending.

The public site sends hardening response headers — HTTP Strict Transport Security, anti-framing, no MIME sniffing and a prudent referrer policy — and the staging environment is marked non-indexable.

Scope: Applies to the public website.

A Content Security Policy that restricts where scripts, styles, fonts, images and connections may load from is being rolled out — applied and verified on staging first, then production.

Scope: Applies to the public website; production rollout after staging verification.

NextGenAMR currently runs as a VBS-operated managed cloud service on AWS, with the operational responsibility, updates, secret handling, logging and backups managed by VBS. Other deployment models are not offered as generic options; the deployment design, responsibilities and data handling are reviewed during an institutional evaluation.

Scope: The only current deployment modality.