Security overview

Myelin is a transit and quality-review layer for R&D data exchanged between a pharma sponsor and its external partners. Files upload to a temporary EU staging tier, are reviewed, and on validation are delivered — checksum-verified per file — into storage the sponsor controls. Myelin is not a system of record and not long-term storage: staged copies are purged automatically seven days after verified delivery, and end users only ever consume data from sponsor infrastructure.

The only US-touching flow is transactional email metadata (recipient and business names) — never file names, file content, or checksums.

• Three-layer role model (platform / bridge / project), enforced server-side only through a single authorization path that reads roles from the database and fails closed.
• Postgres Row-Level Security on every table as an independent, defense-in-depth second layer.
• Partner API keys are 238-bit random secrets stored as SHA-256 hashes, backed by least-privilege service identities the client can see, remove, and kill-switch per bridge.

Every state change — reviews, votes, transfers, configuration, access — appends to a SHA-256 hash-chained audit log. Database triggers reject UPDATE, DELETE and TRUNCATE even for the privileged role, and a persisted watermark defeats silent truncation. An automated integrity verification recomputes the full chain daily; exports ship as CSV or a 21 CFR Part 11-styled PDF, and every export is itself an audited event.

• TLS on every hop; AES-256 at rest (provider-managed keys; CMEK on the pilot roadmap).
• Staged files are reachable only through short-lived signed URLs issued after an authorization check.
• Delivery runs on a dedicated EU worker built for terabyte-scale deliveries — whole-genome runs, full imaging series. Files are streamed with bounded memory, never buffered whole, and each one is checkpointed, so an interrupted delivery resumes instead of restarting. Per-file md5 verification is recorded at delivery.
• Terminal transfer failures page the operator via independent monitoring.

Nightly logical backups stream to a versioned EU bucket under a write-only identity — the backup job cannot delete its own history. Restore-tested: RPO ≤ 24 h, RTO measured in seconds at current volume, with the audit hash chain re-verified intact on the restored copy. Restore tests repeat quarterly, and independent freshness monitoring alerts if backups silently stop. And because delivered data lives in your bucket, a Myelin outage never strands validated data.

If Myelin stopped existing. The exposure worth assessing here is not only a breach — it is a readout stranded mid-review. So the architecture is built to leave nothing hostage: delivered data is already in your bucket and is unaffected; a delivery in flight has never left your partner’s possession and can be sent the way it was sent before Myelin; and the audit trail is exportable in full, on demand, by your own governance users — evidence you already hold, not evidence you would have to request. Continuous export into a client-controlled archive is on the roadmap; today the export is self-service and unlimited.

Two internal adversarial security reviews ran in 2026; confirmed findings were fixed or are tracked openly in a version-controlled register. What is not in place yet is sequenced on real triggers, and we say so:

• Independent penetration test — commissioned at first pilot.
• SOC 2 Type II / ISO 27001 — the observation clock starts when a contract requires it; the documentation set is maintained audit-ready in the meantime.
• Customer-managed encryption keys — pilot tier.
• Single-founder segregation of duties — compensated by the tamper-evident audit trail.

GDPR: Myelin acts as processor; EU residency for all primary data; subprocessor register and Art. 28 DPA position prepared. GxP: a 21 CFR Part 11 / Annex 11 control-traceability matrix and operational SOPs are prepared; electronic signatures are declared out of POC scope with a bounded upgrade path. See also the privacy notice.