Skip to content

Account and organization security

Security controls protect individual accounts and organization-scoped laboratory data. Organization Owners and Admins should combine FlaskTrack controls with documented internal security procedures.

Account controls

  • Use a unique password stored in an approved password manager.
  • Enable two-factor authentication.
  • Save recovery codes offline or in an approved secret store.
  • Review active sessions and revoke unfamiliar devices.
  • Do not share accounts, recovery codes, provider credentials, or API keys.

Organization controls

  • Apply least privilege when assigning roles.
  • Review pending invitations and access requests.
  • Deactivate users promptly when access is no longer required.
  • Rotate integration secrets after suspected exposure.
  • Use separate API keys for separate systems so they can be revoked independently.

Data isolation

Organization data is scoped by organization membership and authorization. API requests also require organization context. Users must not attempt to reuse identifiers or credentials across organizations.

Incident response

When suspicious activity is detected:

  1. revoke the affected session or credential;
  2. rotate related passwords, API keys, or integration secrets;
  3. review the audit trail and affected records;
  4. preserve relevant evidence;
  5. follow the organization’s incident and notification procedures.

FlaskTrack audit records support investigation, but the organization remains responsible for incident classification, regulatory notification, and remediation.