Many lab-software vendors lead with compliance badges, and it is easy to assume you need all of them. Most research labs do not. Buying a compliance-grade platform you do not need costs more and slows you down. This guide explains the requirements that come up most when choosing lab software, who actually needs each one, and when a research platform is the right fit.
HIPAA
HIPAA governs protected health information (PHI): identifiable patient data. It matters if your work touches patient records, clinical samples tied to identities, or anything that could identify a person receiving care. Clinical labs and research handling patient data need a HIPAA-eligible platform and a signed BAA. Basic research that does not store PHI does not. Conspecta does not handle PHI or sign BAAs, so if your data includes patient information, it is not the right fit today.
21 CFR Part 11 and GxP
21 CFR Part 11 is the FDA rule for electronic records and signatures in regulated work: drug submissions, clinical trials, and GLP or GMP environments. It brings audit trails, controlled change management, and formal system checks. Regulated pharma QC, clinical trial data, and manufacturing need it. Discovery and preclinical research, which is most academic and early-biotech work, do not. Conspecta is built for the research side and does not support 21 CFR Part 11 or GxP today.
SOC 2 and ISO 27001
SOC 2 and ISO 27001 are information-security certifications. They are common asks in enterprise and international procurement, and they signal that a vendor follows audited security practices. They are useful, but they are not what protects your data day to day: encryption, tenant isolation, access controls, and backups do. Conspecta is not certified today, and SOC 2 Type II is on our roadmap. In the meantime we encrypt data in transit and at rest, isolate every project at the database level, enforce role-based access, and back up automatically. See our security page for the full list.
Data residency (US vs EU)
Data residency is about where your data physically lives. Some institutions, especially in the EU and UK, require data to stay in a specific region for GDPR or institutional policy. If that applies to you, you need a vendor that offers residency in your region. Conspecta stores and processes data in the United States only today, so labs with a hard EU or regional residency requirement are not a fit yet.
Offline access
A few labs need software that works without an internet connection: air-gapped environments, fieldwork, or strict network policies. Desktop tools fit that better than any cloud platform. Conspecta is cloud-first and runs in the browser, so it is not built for fully offline use.
How to decide
Run through these questions:
- Do you store patient data (PHI)? If yes, you need a HIPAA-eligible platform.
- Are you in a regulated workflow (GLP, GMP, clinical, FDA submissions)? If yes, you need 21 CFR Part 11 support.
- Does your institution mandate ISO 27001 or EU data residency? If yes, confirm the vendor meets it.
- Do you need to work fully offline? If yes, a desktop tool fits better.
If you answered yes to any of these, Conspecta is not built for your case today. If you answered no to all of them, which is the case for most research labs, you are likely over-buying with a compliance-heavy platform, and a modern research tool will serve you better without the overhead.
Where Conspecta fits
Conspecta is built for the research case: no PHI, pre-regulatory work, US-based, online. We are upfront about what we do not have so you do not waste time finding out later. If you are in the regulated or clinical bucket, we will say so. If you are not, you get image analysis, flow cytometry, sample tracking, sequence tools, and figures in one place, without compliance overhead you do not need.
This reflects our honest posture as of mid-2026. Requirements and our roadmap change; see our security page for current details. Product names and trademarks belong to their owners.