1. Our approach
Because Bayes Pharma.ai workspaces hold sensitive scientific, commercial, and — for some customers — health-related evidence, we design security into the platform rather than treating it as an add-on. The practices below describe our general approach; specific technical and organizational measures for a given customer deployment are detailed in that customer's order form, data processing agreement, or security questionnaire response.
2. Encryption
Data moving between your browser and Bayes Pharma.ai services is protected using industry-standard transport encryption (TLS).
Customer content stored in Bayes Pharma.ai's databases and object storage is encrypted at rest using our infrastructure providers' standard encryption capabilities.
3. Access controls & authentication
- Role-based access so users see only the workspaces and data appropriate to their role and organization.
- Reviewer-workflow access controls in Innovator workspaces, so evidence review, sign-off, and package-locking actions are attributable to a named reviewer and role.
- Principle of least privilege for internal Bayes Pharma.ai staff access to production systems and customer content, limited to what is needed to operate and support the Service.
- API access governed through the platform's API access and usage controls, including key issuance and the ability to revoke access.
4. Infrastructure & hosting
Bayes Pharma.ai is hosted on established cloud infrastructure providers that maintain their own physical security, environmental controls, and infrastructure-level certifications. We configure network segmentation, firewalls, and monitoring around our application and database tiers consistent with good practice for a SaaS platform handling sensitive business data.
5. Application security practices
- Secure software development practices, including code review before changes reach production.
- Dependency and library monitoring to identify and remediate known vulnerabilities in third-party components.
- Environment separation between development, staging, and production systems.
- Logging and monitoring of application and infrastructure activity to support detection of anomalous behavior.
6. Customer data segregation
Customer Content is logically segregated by customer and workspace so that one organization's evidence, models, and review history are not visible to another. AI-assisted features are designed so a given customer's confidential inputs are not used to answer another customer's questions or exposed in another customer's outputs.
7. Business continuity & backups
We maintain regular backups of customer content and platform configuration, and design our infrastructure to support recovery from common failure scenarios. Specific recovery-point and recovery-time objectives for an enterprise deployment can be discussed as part of a customer agreement.
8. Vendor & sub-processor management
We rely on a limited set of infrastructure, hosting, email-delivery, analytics, and — for certain AI-assisted features — model-provider sub-processors. We assess sub-processors for appropriate security and data-handling commitments before use, and require contractual confidentiality and data-protection obligations consistent with applicable law and our customer commitments.
9. Compliance alignment
Bayes Pharma.ai designs its data-handling, access-control, and audit-trail practices with alignment to common enterprise and life-sciences expectations, including SOC 2–style trust-services criteria, general data-protection principles reflected in GDPR and CCPA, health-privacy-aware handling of any health-related data supplied under a customer agreement, and GxP-aware design of review, sign-off, and audit-trail features (for example, reviewer identity, timestamps, and locked decision packages). This describes our design intent and program in progress rather than a claim that Bayes Pharma.ai currently holds a specific third-party certification; current certification status and audit reports, where available, can be requested from our team.
10. Incident response & notification
We maintain an internal process for triaging, investigating, and remediating security incidents. Where a confirmed security incident affects customer content in a manner requiring notification under applicable law or a customer agreement, we aim to notify the affected customer without undue delay and to support the customer's own regulatory or contractual notification obligations.
11. Report a vulnerability
If you believe you have found a security vulnerability in a Bayes Pharma.ai product, please report it to us responsibly and give us a reasonable opportunity to investigate and remediate before any public disclosure.