Security and trust
Built to the bar a controlled-substance system demands
CustodyLinx is the evidentiary record for the movement of a controlled substance. The security model is the product: tenant isolation, tamper-evidence, and an immutable audit trail are enforced in the database, not promised in a policy.
Tenant isolation in the database
Every table is protected by row-level security on a default-deny model, enforced in Postgres rather than only in the application. One operator cannot read another operator's packages, manifests, or custody events, and a driver token cannot reach another operator's data. The server is the gate; the UI only hides affordances.
Tamper-evident chain of custody
Custody events are append-only and hash-chained: each event seals the prior event's hash, so any alteration breaks the chain and is detectable. Updates and deletes are blocked at the database. The custody record is evidence, built to be provable in an audit, not merely asserted.
Immutable audit log
Every mutating action is recorded with the actor, the client IP, the user agent, and a server timestamp, through a write-only path with no update or delete policy. The audit trail cannot be edited after the fact, by anyone.
Least-privilege access
Access is scoped by role across platform staff, operator administrators, operator members, and field tokens. Members see only what their role and operator allow. Platform-level configuration, like the compliance graph, is restricted to platform staff.
Private document storage
Scanned documents, signatures, and photo evidence live in private storage and are served only through short-lived signed links. There is no public bucket, and no untracked paper: any unavoidable paper is captured as an image onto the custody chain.
Secrets and credentials
Regulator API keys and narcotics-license credentials live in a secrets vault, pulled by workers at runtime, never committed to source. Regulator connections default to sandbox and require explicit promotion before any production credential is used.
Validated, controlled inputs
Every input is validated at the boundary, and standardized values (product class, unit of measure, role, status, jurisdiction) come from controlled picklists, not free text. Bad input is rejected with a precise error, never silently accepted.
Managed, resilient infrastructure
The platform runs on managed cloud infrastructure with encryption in transit and at rest. Nothing critical lives on a local machine; the source of truth is the repository and the managed database, reachable from any device.
Enforced by design, not by policy
A policy document can be ignored. A database constraint cannot. CustodyLinx puts isolation, append-only integrity, and audit at the data layer, so the controls hold even if the application has a bug.
Compliance posture
CustodyLinx is built to a SOC 2 control bar, and is engineered to support the audit, recordkeeping, and chain-of-custody requirements that govern controlled-substance logistics, including the EPCIS and DSCSA direction the pharmaceutical supply chain is converging on.
Formal SOC 2 attestation and a detailed data-retention schedule are part of the readiness program and are provided during contracting. We do not claim a certification we have not completed; where a control is aligned-to rather than attested, we say so plainly.
Reviewing CustodyLinx for your program?
We are happy to walk a security or quality team through the controls in detail.