Security
How ChemSwatch protects your data
A plain description of what the platform does today. ChemSwatch does not currently claim third-party certifications.
Tenant isolation
Every organisation-owned record carries an organisation ID, and every query is scoped to the caller's organisation in the service layer shared by the REST API and the hosted MCP endpoint. The shared reference library is read-only to organisations.
API keys
Keys are generated with a cryptographically secure random source, shown once, and stored only as a SHA-256 hash with a short display prefix. Keys carry explicit scopes, can expire, and can be revoked immediately. API keys cannot create other keys or manage members.
Passwords and sessions
Passwords are hashed with scrypt and a per-user salt. Browser sessions use a random token in an httpOnly, SameSite=Lax cookie; only a hash of the token is stored server-side, and sessions expire.
Role-based access
Owners, admins, editors and viewers. Viewers get read access only; editors can change products, SDSs, inventory and risk assessments; admins manage members, API keys, webhooks and settings.
Audit log
Changes are recorded with the acting user or API key, the entity affected and a timestamp, and are visible to your organisation in the activity log.
Signed webhooks
Outbound webhooks are signed with HMAC-SHA256 over a timestamp and the raw body, so receivers can verify authenticity and reject replays.
AI processing
When AI SDS extraction is enabled, uploaded SDS documents are sent to the Anthropic API for structured extraction. Without an API key configured, ChemSwatch uses its deterministic on-server parser only. Extracted data is always held as a draft for human review before publication.
Public links
QR codes and SDS share links use long random tokens and expose read-only safety information for a single SDS or location. Administrators can switch public links off for the whole organisation.