Security architecture
Controls that protect molecular discovery work.
This page describes implemented product controls. It does not claim a certification that MolexIO has not earned.
Identity and sessions
Passwords use salted scrypt derivation. Session and recovery secrets are random, expiring, revocable, and stored only as cryptographic hashes. Login attempts are locked temporarily after repeated failures.
Organization and project boundaries
Application routes require an authenticated session. Each project identifier is resolved against the user’s organization before data or compute is accessed; foreign project identifiers return a non-disclosing not-found response.
Recovery and email
Email verification and password recovery use single-use expiring links delivered through deployment-owned SMTP. Password changes revoke all active sessions.
Deployment responsibilities
Production deployments must enable HTTPS-only cookies, TLS, encrypted backups, monitored SMTP, secret management, logging, patching, and an independent security review. SSO, MFA and formal compliance attestations are roadmap items unless explicitly contracted and documented.