Security
Your lab's data never leaves its own boundary.
Not a compliance claim — a description of how the system is actually built.
How it's actually built
Four things, verified in the codebase, not asserted in a copy deck.
Per-tenant data isolation
Each laboratory's documents are indexed into a separate vector store — QualiBOT can only retrieve from your lab's own uploaded records, never another tenant's.
PII redaction before indexing
Documents pass through a redaction step before they're indexed, including recognizers built for regional identifiers — Tanzanian phone numbers, NIDA national ID format, and TIN numbers — not just generic patterns.
Self-hosted inference
QualiBOT's language model runs on infrastructure we control, not a third-party AI API call for every question — consistent with keeping lab data inside a system you can audit.
Answers are gated, not guessed
Retrieval is scored against a confidence threshold before any answer is generated — below it, QualiBOT says it doesn't have the information, rather than filling the gap.
What's not here yet
No compliance certification (SOC 2, ISO 27001, or similar) is claimed — none has been pursued yet. This page describes real architecture decisions, not an audited compliance posture. If you need a formal security review for an evaluation, talk to the team directly rather than relying on this page alone.