QMS
What the sign-in gate on this demonstration actually enforces, stated exactly.
Enforced here, now
- Access is enforced at the network edge: server-side middleware authenticates every request,
every method, every path, before any page, script or data is served. There is no
client-side-only gate anywhere.
- One named user account exists; there are no shared or generic logins (the 21 CFR 11.300(a)
pattern).
- The password is stored only as a salted PBKDF2-HMAC-SHA256 hash (100,000 iterations, the
platform's cap, stated rather than padded) in an encrypted platform secret. It appears in no
source code, repository or log, and nothing served to a browser can be used to derive it.
- Sessions are server-side records: 15 minutes idle, 12 hours absolute, both enforced at the
edge, with an HttpOnly, Secure, SameSite cookie that scripts cannot read.
- The account locks after 5 consecutive failed attempts, doubling the lockout each further
failure, with an identical response for every failure cause so nothing can be learned from
the error. All comparisons are constant-time.
- Every sign-in attempt, lockout, sign-out and expiry is recorded in an append-only log with
UTC time, source address and outcome (the 11.300(d) pattern), viewable signed-in at
/security-log. The application itself cannot write to that log.
- Authenticated responses are never cached (Cache-Control: no-store) and carry a strict
Content-Security-Policy, frame denial and transport security headers.
Stated limits, because a reviewer will find them anyway
- The gate controls who gets in, not what leaves afterwards: the demo is one page whose
fictional data lives in the signed-in viewer's browser.
- Lockout counters use edge storage that is eventually consistent between locations; a widely
distributed attacker could exceed the 5-attempt line before every location sees the lock.
The constant failure delay and the credential's storage design carry that case; a bot
challenge on the form is the next planned layer.
- The in-app role selector demonstrates an access-model design; it is not a security control,
and the application says so itself.
- This demonstration is not a validated GxP system and claims no Part 11 or Annex 11
compliance. The patterns above are genuinely implemented; certification words are not used.