Security & Trust

GHSLogic runs entirely on managed, independently audited cloud infrastructure. We do not operate our own servers.

• Application backend — Google Cloud Run (US region), a fully managed, autoscaling container platform.
• Frontend — Vercel, served over a global CDN.
• Database & file storage — Supabase (managed PostgreSQL and object storage).

Google Cloud, Vercel, and Supabase each maintain their own SOC 2 Type II attestations; their reports are available from those providers under NDA. GHSLogic itself is not yet SOC 2 certified — see Compliance status below.

• In transit — all traffic is served over HTTPS/TLS. HTTP Strict Transport Security (HSTS) is enforced in production.
• At rest — database and file storage are encrypted at rest by our infrastructure providers.
• Secrets — multi-factor authentication secrets are additionally encrypted at the application layer (AES) with a key derived from a server-side secret, so they are never stored in plain text.

• Passwords are hashed with bcrypt; we never store them in plain text.
• Optional multi-factor authentication (TOTP) — recommended for accounts handling trade-secret data.
• Account lockout after repeated failed logins, plus rate limiting on authentication and other sensitive endpoints.
• Sessions use signed, short-lived tokens with an absolute cap and an idle timeout; logging out in one tab propagates to others.
• Role-based access within an organization — Admin, Author, and Reviewer. Reviewers see SDS concentration ranges only; exact concentrations and CBI identities are masked from them.
• Project access is enforced through a single organization-aware authorization gate to prevent cross-account data access.

CBI and trade-secret handling is a core part of the product, not an afterthought:

• Database access is governed by row-level security policies on every table.
• Exact concentrations and confidential component identities are masked for read-only reviewers and never appear in their views or exports.
• Our error-monitoring tooling is configured to strip request bodies, cookies, authentication headers, and query strings, and session replay is deliberately disabled — so confidential formulation data is never captured in diagnostics.
• Uploaded SDS content is treated strictly as data by our AI extraction pipeline; embedded instructions in a document cannot change system behavior.

GHSLogic uses Anthropic's Claude API to extract structured data from uploaded SDSs and to draft translations. Deterministic regulatory classification never relies on the AI model — the model assists with data extraction and drafting only, and every output is flagged as a draft requiring professional review. Data sent to the API is processed under Anthropic's commercial terms and is not used to train models.

• A comprehensive audit log records significant events (authentication, data changes, exports, administrative actions) with timestamp, actor, and source IP.
• Application errors are captured by a monitoring service with the privacy scrubbing described above.
• Dependencies are monitored for known vulnerabilities and updated on a regular cadence; changes are gated by an automated test suite before deployment.

• Your data is yours. We do not sell it or use it for advertising.
• Deleting a project or your account removes the associated database records and purges the underlying stored files (uploaded SDSs, exports, logos) from object storage.
• Account deletion also cancels any active subscription.

We rely on the following subprocessors to deliver the service:

GHSLogic is built on SOC 2 Type II–certified infrastructure (Google Cloud, Vercel, Supabase) and follows the security practices described on this page. GHSLogic does not currently hold its own SOC 2 attestation. If your procurement process requires one, contact us at security@ghslogic.com — we're happy to discuss your requirements and timeline.

If you believe you've found a security vulnerability, please email security@ghslogic.com with details. We appreciate responsible disclosure and will work with you to confirm and address the issue. Please do not publicly disclose an issue before we've had a chance to respond.

Independent of security: every classification, label, and SDS GHSLogic produces is a draft decision-support document. It must be reviewed and signed off by a qualified SDS/GHS/regulatory professional before use, distribution, or submission to any authority.