Many lab-software vendors lead with compliance badges, and it is easy to assume you need all of them. Most research labs do not. Buying a compliance-grade platform you do not need costs more and slows you down. This guide explains the requirements that come up most when choosing lab software, who actually needs each one, and when a research platform is the right fit.

HIPAA

HIPAA governs protected health information (PHI): identifiable patient data. It matters if your work touches patient records, clinical samples tied to identities, or anything that could identify a person receiving care. Clinical labs and research handling patient data need a HIPAA-eligible platform and a signed BAA. Basic research that does not store PHI does not. Conspecta’s standard terms exclude PHI. Identifiable patient data needs a BAA, which is quoted with a Business plan, so talk to us before you put any patient information in.

21 CFR Part 11 and GxP

21 CFR Part 11 is the FDA rule for electronic records and signatures in regulated work: drug submissions, clinical trials, and GLP or GMP environments. It brings audit trails, controlled change management, and formal system checks. Regulated pharma QC, clinical trial data, and manufacturing need it. Discovery and preclinical research, which is most academic and early-biotech work, do not. Conspecta is built for the research side. Compliance here belongs to your validated process rather than to a certificate a vendor holds, so what we provide is the validation support and documentation that process needs, quoted with a Business plan. If that is on your roadmap, talk to us.

SOC 2 and ISO 27001

ISO 27001 is a certification. SOC 2 is an auditor’s report, either Type I at a single point in time or Type II over a period. Both are common asks in enterprise and international procurement, and they signal that a vendor follows audited security practices. They are useful, but they are not what protects your data day to day: encryption, tenant isolation, access controls, and backups do. Conspecta’s controls follow the SOC 2 Trust Services Criteria and run today, and ISO 27001 covers the same controls. There is no audit report yet. When a contract needs one, we engage an auditor for a Type I, so if a report gates your procurement, ask. Day to day we encrypt data in transit and at rest, isolate every project at the database level, enforce role-based access, and back up automatically. See our security page for the full list.

Data residency (US vs EU)

Data residency is about where your data physically lives. Some institutions, especially in the EU and UK, require data to stay in a specific region for GDPR or institutional policy. Conspecta stores and processes data in the United States, with Standard Contractual Clauses for EU transfers. Another region is quoted with a Business plan, so ask if your institution requires one.

Offline access

A few labs need software that works without an internet connection: air-gapped environments, fieldwork, or strict network policies. Desktop tools fit that better than any cloud platform. Conspecta is cloud-only and runs in the browser, so it is not built for fully offline use, and we do not offer a self-hosted or on-premises install. That one is a firm no rather than a roadmap item: we cannot secure, patch, or stand behind a deployment we do not run.

How to decide

Run through these questions:

  • Do you store patient data (PHI)? If yes, you need a HIPAA-eligible platform.
  • Are you in a regulated workflow (GLP, GMP, clinical, FDA submissions)? If yes, you need 21 CFR Part 11 support.
  • Does your institution mandate ISO 27001 or EU data residency? If yes, confirm the vendor meets it.
  • Do you need to work fully offline? If yes, a desktop tool fits better.

If you answered no to all of them, which is the case for most research labs, you are likely over-buying with a compliance-heavy platform, and a modern research tool will serve you better without the overhead.

Where Conspecta fits

Conspecta’s standard plans cover the research case: pre-regulatory work, no PHI, data in the United States, in the browser. That is most academic and early-biotech labs, and it is what the free and academic plans are priced for — image analysis, flow cytometry, sample tracking, sequence tools, and figures in one place.

Regulated and clinical work is a quoted agreement. HIPAA with a signed BAA, Part 11 validation, another data region, and SSO are each priced with a Business plan and settled in the contract. Tell us the requirement and you will get a straight answer on whether we can meet it.

This reflects our honest posture as of mid-2026. Requirements and our roadmap change; see our security page for current details. Product names and trademarks belong to their owners.