Skip to main content
PricingContact
Sign in / Register
Back to Blog
Tutorial
June 11, 2026

Do Research Labs Need a Compliant LIMS? HIPAA, Part 11, ISO 27001, and Data Residency

A plain-English guide to lab compliance: what each requirement means, who actually needs it, and when a research platform fits instead of a regulated LIMS.

Many lab-software vendors lead with compliance badges, and it is easy to assume you need all of them. Most research labs do not. Buying a compliance-grade platform you do not need costs more and slows you down. This guide explains the requirements that come up most when choosing lab software, who actually needs each one, and when a research platform is the right fit.

HIPAA

HIPAA governs protected health information (PHI): identifiable patient data. It matters if your work touches patient records, clinical samples tied to identities, or anything that could identify a person receiving care. Clinical labs and research handling patient data need a HIPAA-eligible platform and a signed BAA. Basic research that does not store PHI does not. Conspecta’s standard terms exclude PHI and we do not sign BAAs by default, so if HIPAA applies to your work, talk to us about an enterprise agreement before you put any patient information in.

21 CFR Part 11 and GxP

21 CFR Part 11 is the FDA rule for electronic records and signatures in regulated work: drug submissions, clinical trials, and GLP or GMP environments. It brings audit trails, controlled change management, and formal system checks. Regulated pharma QC, clinical trial data, and manufacturing need it. Discovery and preclinical research, which is most academic and early-biotech work, do not. Conspecta is built for the research side. Regulated workflows need validation documentation and dedicated support beyond our standard service, so we take them on as an enterprise engagement rather than something you switch on — if that is on your roadmap, talk to us.

SOC 2 and ISO 27001

SOC 2 and ISO 27001 are information-security certifications. They are common asks in enterprise and international procurement, and they signal that a vendor follows audited security practices. They are useful, but they are not what protects your data day to day: encryption, tenant isolation, access controls, and backups do. Conspecta is not certified yet. Our controls are built to SOC 2 standards and we are ready to begin the audit, so if certification is a gating requirement for your team, tell us and we will prioritize it. Day to day we encrypt data in transit and at rest, isolate every project at the database level, enforce role-based access, and back up automatically. See our security page for the full list.

Data residency (US vs EU)

Data residency is about where your data physically lives. Some institutions, especially in the EU and UK, require data to stay in a specific region for GDPR or institutional policy. Conspecta stores and processes data in the United States today, and regional residency is not a standard option — if your institution requires it, it is an enterprise conversation rather than a flat no.

Offline access

A few labs need software that works without an internet connection: air-gapped environments, fieldwork, or strict network policies. Desktop tools fit that better than any cloud platform. Conspecta is cloud-only and runs in the browser, so it is not built for fully offline use, and we do not offer a self-hosted or on-premises install. That one is a firm no rather than a roadmap item: we cannot secure, patch, or stand behind a deployment we do not run.

How to decide

Run through these questions:

  • Do you store patient data (PHI)? If yes, you need a HIPAA-eligible platform.
  • Are you in a regulated workflow (GLP, GMP, clinical, FDA submissions)? If yes, you need 21 CFR Part 11 support.
  • Does your institution mandate ISO 27001 or EU data residency? If yes, confirm the vendor meets it.
  • Do you need to work fully offline? If yes, a desktop tool fits better.

If you answered no to all of them, which is the case for most research labs, you are likely over-buying with a compliance-heavy platform, and a modern research tool will serve you better without the overhead.

Where Conspecta fits

Conspecta is built for the research case: no PHI, pre-regulatory work, US-based, online. If you are in the regulated or clinical bucket, we will say so. If you are not, you get image analysis, flow cytometry, sample tracking, sequence tools, and figures in one place, without compliance overhead you do not need.

This reflects our honest posture as of mid-2026. Requirements and our roadmap change; see our security page for current details. Product names and trademarks belong to their owners.