BioSure was built for labs that get inspected. Every workflow, control, and data policy is documented, auditable, and available to review.
We don't treat compliance as an optional checkbox. Each framework below is aligned to the specific workflow surfaces inside BioSure — not a blanket SOC 2 logo in the footer.
Every report template, air-sampling workflow, and gowning-qualification form is aligned to the 2023 USP 797 revision — with configurable limits for ISO 5 / 7 / 8 cleanrooms.
Every mutation is captured as an immutable record with user, timestamp, intent, and cryptographic attribution. E-signatures meet Part 11 identification, non-repudiation, and linking requirements.
BioSure operates as a Business Associate for labs handling PHI. We sign a BAA on day one and follow the HIPAA Security Rule for administrative, physical, and technical safeguards. See the dedicated HIPAA section below.
Our cloud infrastructure is built on SOC 2 Type II-audited services. The BioSure application layer is on track for our own Type II report by Q3 2026 — Type I completed January 2026.
Documentation, method validation, and equipment calibration workflows are modelled after ISO 17025 expectations — helping your lab maintain accreditation without duplicating records.
When your laboratory handles data that qualifies as Protected Health Information (PHI), BioSure operates as your Business Associate under the U.S. Health Insurance Portability and Accountability Act. We execute a Business Associate Agreement (BAA) before any PHI is processed, and apply the administrative, physical, and technical safeguards required by the HIPAA Security Rule (45 CFR Part 164, Subpart C).
RainerTek LLC executes a BAA with every customer that handles PHI in BioSure — before go-live, at no additional cost. The BAA defines permitted uses, safeguard obligations, breach-notification timelines, and return-or-destroy terms on termination.
Request a BAA →CFU counts, organism IDs, and cleanroom results describe a facility, not a patient. PHI can still enter the platform through free-text notes, uploaded documents, or contact records — so once a BAA is in place we hold the entire tenant to HIPAA-grade safeguards.
Role-based access control and per-tenant isolation enforce the HIPAA “minimum necessary” standard — users and BioSure operators reach only the records their role requires, and every access is logged.
Security Rule safeguards · 45 CFR §164.308–316
HIPAA compliance is a partnership. BioSure secures the platform; your lab governs how PHI is entered, who is invited, and how results are disclosed. This split is codified in our BAA.
BioSure — Business Associate
Your lab — Covered Entity / BA
Sign a BAA before any PHI is processed
Sign a BAA with BioSure before storing PHI in the platform
Encrypt PHI at rest (AES-256) and in transit (TLS 1.2+)
Enter only the PHI your testing and reporting genuinely require
Enforce access controls, audit logging, and tenant isolation
Provision users and assign least-privilege roles for your team
Maintain backups, disaster recovery, and infrastructure security
Manage workforce onboarding, offboarding, and credential hygiene
Detect, investigate, and report breaches of PHI we process
Obtain patient authorizations and issue any required notices
Return or destroy PHI on termination of the agreement
Export or confirm disposition of PHI during offboarding
Breach notification · §164.410
In the event of a breach of unsecured PHI, BioSure notifies the affected covered entity without unreasonable delay and no later than 60 calendar days after discovery — with the detail you need to meet your own notification obligations. We have recorded zero data incidents since 2024.
Subcontractors · §164.308(b)
Where a subprocessor may create, receive, maintain, or transmit PHI on our behalf — such as our AWS hosting and storage — we hold a signed HIPAA business associate agreement with them. The full subprocessor register is published below.
Four domains, continuously audited. Available in a SIG-Lite or CAIQ questionnaire, and documented in our architecture brief (NDA on request).
01 · Data
02 · Access
03 · Infrastructure
04 · Operations
We keep a public register of every service that processes your lab's data. Request a SOC 2 report, CAIQ, BAA template, or penetration-test summary — typical turnaround is one business day.
Amazon Web Services
Primary hosting, object storage
US East / West
Cloudflare
CDN, DDoS mitigation, WAF
Global edge
Postmark
Transactional email delivery
US
Sentry
Error monitoring (opt-in)
US / EU
Stripe
Billing & payments
US
Datadog
Application performance monitoring
US
Continuously audited · 99.97% uptime · 0 data incidents since 2024
Raise a concern →