Security Overview

BCILattice is built on a local-first, data-sovereignty model. The most sensitive asset, raw brain signal recordings, never leaves the researcher's machine unless they explicitly choose to upload it. This architecture minimises attack surface and simplifies institutional data governance workflows.

Local Data Protection

BCILattice stores all session data, preprocessed datasets, and trained models on your local file system. The data directory is configurable (default: user home directory). BCILattice does not apply its own encryption to local files, local data security is governed by your OS and disk encryption policy (e.g., BitLocker, FileVault, LUKS).

• The local database is password-protected and bound to loopback only, not reachable from the network
• The local backend is bound to loopback only, not reachable from other machines
• Raw data files are never modified in place, BCILattice creates derived copies in a separate data directory
• Application logs do not contain patient identifiers or raw signal data

Cloud Security

Encryption

Authentication & Access

• Web sessions, BCINexus browser sessions are held in HttpOnly cookies and forwarded server-side to the API.
• Desktop tokens, BCILattice desktop authenticates to BCINexus with bearer tokens stored in the local application profile.
• Role-based access control, team workspaces support owner, admin, and member roles.
• SAML / SSO and MFA, not currently self-service features. Enterprise identity integrations require a scoped implementation agreement.
• API keys, not currently exposed as a general customer feature; service integrations should use the supported application authentication flow.

Audit Logging

BCILattice and BCINexus maintain application audit records for key actions, including:

• User authentication events (sign-in and failed attempts)
• Dataset uploads, downloads, and deletions
• Study creation, modification, and sharing
• Team workspace membership changes
• Settings changes (billing, roles, integrations)

Cryptographic log sealing, webhook streaming, and SIEM export are not currently exposed as product features; they require a separate enterprise implementation.

HIPAA Readiness

BCILattice can support HIPAA-aligned local-first workflows when deployed under an organisation's own policies, but HIPAA compliance depends on the customer's environment, contracts, and operating procedures.

How BCILattice supports HIPAA

To discuss a BAA or deployment controls, email [email protected] with your organisation name and the subject line "BAA Request".

GDPR Readiness

BCILattice and BCINexus include controls that support GDPR obligations for organisations in the European Union and EEA. When BCINexus processes customer-uploaded personal data, the applicable processor terms must be covered by the signed customer agreement.

Our Privacy Policy and manual legal request process are available at Legal Documents and from [email protected].

GxP / 21 CFR Part 11 Readiness

BCILattice may be used as one component in regulated pharmaceutical or medical device research workflows, but it is not itself a validated GxP or 21 CFR Part 11 system out of the box.

For regulated deployments, contact [email protected] to scope validation documentation, deployment controls, and customer responsibilities.

SOC 2 & ISO 27001 Status

Vulnerability Management

• Dependency review, dependencies should be reviewed during release and enterprise security checks
• Static analysis, Python and TypeScript checks are used during development where configured
• Penetration testing, third-party testing and report access can be scoped during enterprise security review
• Responsible disclosure, Report vulnerabilities to [email protected]. Reports are reviewed and prioritized by severity and affected surface.
• CVE policy, critical dependency issues are triaged for mitigation, upgrade, or deployment guidance based on exploitability and release impact.

Incident Response

IT Security Checklist

For IT administrators evaluating BCILattice:

Security Contact