Deployment, security & what we model

Deployment & security — for IT / LIS

A Next.js web app on Vercel (US regions); data in Supabase (managed Postgres, US). No on-prem install; nothing runs inside your LIS.

Your typed inputs — lab configuration, modeled economics, and (optional) the actuals you enter — plus any files you choose to attach. Modeling is deterministic and client-side; results are computed in your browser. No assay raw data, instrument files, or specimens are uploaded. Two things do leave the browser when you use them: (1) SOP documents/diagrams you attach are stored in our managed file storage (Supabase, US); (2) when you use AI SOP-import or AI data-mapping, only the TEXT you provide is sent once to our AI sub-processor, Anthropic (US), to draft a structured result for your review — PDF and image files are NEVER sent to the AI vendor, and the text is screened for identifiers first. Not on a schedule, and Anthropic does not train on it; it is retained for a limited period for trust & safety and then deleted, per Anthropic’s then-current Commercial Terms (we do not set that period, so we do not quote a number for it). Both AI features are OPT-IN per use, and can be turned off per lab — see “Turn off AI parsing” below.

AI-assisted parsing can be disabled per lab in Settings ▸ AI-assisted parsing (Admin only). When off, the AI SOP-import and AI column-mapping features are hidden AND the server routes refuse them — including a direct request that bypasses the UI — so the lab uses manual column mapping and manual SOP entry instead. Stated precisely, because your policy may turn on it: the server check reads the flag on each AI request and refuses on a definitive OFF — and also refuses when that read is undetermined (a database error or an unparseable workspace record), rather than proceeding. The gate fails CLOSED: an unverifiable setting costs a retry on an optional feature, which is the cheaper error than an irreversible egress against your opt-out. The one case that still proceeds is a tenant with no saved settings at all, which is a definitive answer (nobody has turned it off) rather than an undetermined one. The restriction to Admins is likewise enforced at the application layer — the flag is stored in the workspace record, and the database write path admits Contributors — so treat it as a policy control with an app-layer guard, not a database-level barrier. Both are on the roadmap to harden. Everything else (deterministic in-browser modeling) is unchanged.

A Board Summary can be published as a share link: a server-minted 192-bit token at /s/<token> that resolves, WITHOUT a login, to a frozen snapshot of the rendered lab P&L (never the raw workspace). You choose the lifetime, up to 180 days, and can revoke any link at any time; expiry and revocation are enforced in the database, and unknown, expired and revoked tokens are indistinguishable to a recipient. Two things to know when you set policy: any Contributor (not just an Admin) can mint one, and a lab can hold up to 50 active links at once. Existing links are listed and revocable in the Board view.

BenchForge is a planning/economics tool — it is NOT designed for PHI, and customers are contractually instructed to keep PHI out. No patient identifiers, no specimen-level data, no results. Inputs are aggregate (volumes, costs, reimbursement, turnaround). Attached SOPs/diagrams are business-confidential documents stored in Supabase (US); the PDF/image files themselves are never sent to the AI sub-processor — only SOP text you provide is (once, when you run AI SOP-import). De-identify what you paste, or turn off AI parsing per tenant. Keep PHI out of every field and file.

Per-tenant data is row-level-security (RLS) isolated in Postgres; a workspace member sees only their tenant. Roles: Admin / Contributor / Read-only. Sign-in is email + password, with opt-in two-factor (TOTP authenticator app) available today per user — required by the APPLICATION before it opens the workspace, not enforced at the database layer. Stated with the same candour as the fail-closed AI gate above: this gate fails OPEN — if the app cannot read whether a session has passed the second factor (an auth-endpoint error or timeout), it opens the workspace rather than locking everyone out for the length of the blip; the password check has already passed at that point. Org-enforced MFA policy and SSO/SAML are on the roadmap. See the IT & Security Review Packet for the precise scope.

Product-usage analytics (which features are used) are pseudonymous, opt-out, and honor Do-Not-Track — no PHI, no account identity. Toggle it in Settings ▸ Privacy & analytics. Separately, and disclosed because the opt-out does NOT cover it: application errors are recorded to our own database (no new vendor) with a truncated error message plus your account and workspace identifier, so crashes still reach engineering when a user has opted out. See Privacy Policy §2(g).

SSO / SAML (Okta, Entra ID, Google Workspace) and a SOC 2 Type II program are planned for enterprise deployments. (Managed cloud storage for attached SOPs has shipped — see "What leaves the browser" above.)

What BenchForge models today

Cost per test, net margin, and net — per assay and rolled up to the lab P&L, from accession through sign-out.

Pooled-labor and shared-instrument contention find the real bottleneck; staffing/capex what-ifs are capped at the next bottleneck they expose.

Reruns decomposed by flavor (re-extract / re-collect / re-sequence / top-off), with upstream re-collect propagation.

P90 TAT with M/M/1 queueing and per-device batch waits.

Billed (allowed) → collected, with prior-auth, denials, appeals, write-offs, days-in-AR and a realization rate. Per-assay, per-payer.

Known gaps — on the roadmap, and exactly what we want alpha feedback on

An 835 names its payer, but reconciling to actuals back-fits one blended realization per assay — the payer identity isn’t yet used to calibrate each payer segment separately.

A specimen that consumes cost and yields no reportable (e.g. FFPE tissue exhausted) is modeled as recoverable rework today, not a distinct billable-zero outcome.

DNA+RNA co-extraction into one report, and cellularity/LOD-driven sequencing depth. (Tumor-normal pairing itself is modeled — a matched-normal workflow composed onto the report.)

Reanalysis / reinterpretation campaigns, cloud egress/retrieval, and per-data-type storage lifecycle.

The one-time analytical validation project (concordance, LoD, precision across lots) as a first-class launch cost, distinct from platform adoption.

A re-sequence re-runs the sequencer’s reagent/run share; the downstream secondary compute, duplicate storage, and re-interpretation it triggers aren’t yet re-costed.

Send-out / reference-lab volume is modeled in the what-if and per-assay “insource vs send-out” tools, not yet as a first-class daily P&L/TAT disposition.

Default-assumption sources