SmartBook · For the people who sign the contract

A lab record you can prove.

SmartBook is an electronic lab notebook built to stand as a system of record under FDA 21 CFR Part 11. The proof sits in the database, where an inspector can check it, and leaving takes one click.

Walk it yourself on the demo →Part 11, clause by clause →

Records that can't be quietly changed

The audit trail, every earlier version and every signature can only ever be added to, never edited or deleted, and the database itself enforces that, not just the software on top. Each audit entry is sealed to the one before it, so tampering breaks the seal, and an hourly check tells QA.

One record per real thing

A compound drawn a second time names the record it already is. An isolate typed two ways finds one record. A project is one record, whether it was created from a notebook or from the Projects page. A duplicate is refused with the existing record's name, so nobody has to merge them later. Where history already left two — two projects, or one isolate filed under two spellings — folding them together is a reviewed decision that versions every record it moves and retires the other rather than deleting it. Until someone asks, both records say they are one.

An assistant that knows the whole lab

Ask one question across assays, compounds, inventory and your documents, and get the answer, the chart or the slide deck. It shows what it saw and each step it took, and nothing it makes joins the record until a named person accepts it.

Leaving should take one click

Every member can take everything they can open as a spreadsheet. QA can take the workspace's records with their files, signatures and history, and the audit trail, as one open archive. There's no ticket and no quote.

Start with only what you need

One click by an administrator (Simple mode) hides notebooks, projects, experiments, analysis, inventory containers and the tile view for the whole organization. Each switch is recorded with a reason, nothing is deleted, and any of them comes back unchanged.

Running on demo
Every path in this pamphlet, on demo.springmilllab.com, with a seeded workspace you can click through.
Designed, not yet stood up
The compliance tier: your own encryption key, storage that can't be overwritten, and a database mirrored across two data centers, all written as code and ready to deploy.
Not yet
A SOC 2 report or a third-party penetration test. We'll share our readiness assessment and every open gap.
The paths
  1. 2BacteriologyFrom isolate to signed MIC call
  2. 3VirologyEvery plate says what it ran in
  3. 4ChemistryOne record per molecule
  4. 5The AI assistantOne question across the whole lab
  5. 6Your data and the AIWhat it sees, and what’s kept
  6. 7InventoryEvery use against a record
  7. 8Quality & complianceAudit us before the first call
  8. 9CybersecurityIs my data safe? The plain answer
  9. 10Always upIs it up, and how would we know?
  10. 11Bailing outLeaving should take one click
Paths Through SmartBook1 / 11 · Overview
BacteriologyFor the head of microbiology

From isolate to signed MIC call.

Readings go in as typed. The S/I/R call and the summary statistics are worked out beside them, each traceable to the table row and the reading it came from.

Take the guided tour →Build your Basic MIC assay yourself →

The walk on demo

  1. Find an isolate. Search the strain library for "KPC Klebsiella". "E. coli" and "Escherichia coli" find the same record, and each isolate lists the runs it was tested in.
  2. Check potency. SMP-B0001's Activity tab shows its MIC on each isolate beside cefepime, ceftriaxone and ciprofloxacin, with MIC50 and MIC90. A censored value stays a bound, such as ">64".
  3. Open the panel. On "MIC panel: SMP-B0001 vs ESBL Enterobacterales, run 1", the comparators carry S/I/R badges that cite EUCAST v16.1; hover one to see its row. SMP-B0001 gets no call, because no breakpoint has been published for a new compound.
  4. See the correction. History shows isolate 6210251194 corrected from 4 to 2 µg/mL after signing, with its reason. The earlier signatures read "amended since".
  5. Compare runs. Run 1 against run 2, matched by isolate, with each one-dilution drift flagged.
  6. Fit a curve. The dose-response assay shows the IC50 with its 95% interval, the Hill slope and R², beside the data.

What it does

  • Each call cites its table version and row. A value that straddles a breakpoint reads "can't tell", and a new table never quietly re-calls old results.
  • A QC strain out of range blocks signing until someone accepts or invalidates the run, with a reason. You pick a run's QC strains when you set it up and see which of its agents each one has a range for. Each QC reading shows in or out of range as you type it. A QC reading SmartBook can't read as an MIC says "QC not checked" and blocks signing the same way; it's never passed silently.
  • One record per isolate, enforced by the database, whether its ID is typed with spaces, hyphens, dots, a number sign, a colon or none, in any case. An isolate filed twice before that rule is flagged on both records, and merged into one through review. A spreadsheet of corrections updates every exact match in one reviewed batch; a row that could be two isolates is refused.
  • A correction to a signed panel is an amendment with a reason, and History names the cell.
  • On a large monitor, or two screens side by side, a panel grows into the space beside the page before it scrolls: all 16 columns of an eight-agent run in duplicate fit on screen at once, and the text around it keeps a readable width.
  • Set up a panel by hand: pick its isolates, singly, a strain group at once, or a column of IDs pasted from a spreadsheet (a line that matches no record is named, never guessed), and its agents with their replicates and each one's starting concentration, and the empty table is laid out. Right-click an agent's column there to add a replicate or remove an empty one from the end, as a new version.
  • Also built and tested, ready for your data: checkerboard FICI, time-kill calls, fold-potentiation, serum shift, and 96- and 384-well plate maps with their controls, % inhibition and Z′.
Where it stops
  • No plate-reader file import. MICs and plate readings are typed, pasted or uploaded as a spreadsheet.
  • Resistance tags are free text. Normalizing them to CARD, and reading genes from genotype files, are on the roadmap.
  • The built-in EUCAST table is a curated subset covering Enterobacterales, Pseudomonas and Acinetobacter against 12 agents. Labs import their own CLSI or ECOFF tables, and can make their CLSI table the default for new assays, with EUCAST beside it.
Paths Through SmartBook2 / 11 · Bacteriology
VirologyFor the head of virology

Every plate says what it ran in.

The cell line and the plate's conditions are part of its signed content, and the cell bank behind each run is on the record, down to the passage.

Take the guided tour →

The walk on demo

  1. The cell lines. Vero E6 (RRID CVCL_0574) and HepG2, each with its host species and source, and the assays run in it. Try registering "VeroE6": it's refused, naming Vero E6, and nothing is written.
  2. The template. "Cytotoxicity dose-response (Vero E6)" picks the cell line from the library, so nobody types it, and freezes it on each plate when the plate is made.
  3. The signed run. "Cytotoxicity: SMP-B0001 and CIP on Vero E6": the conditions above the readings, and the fitted curve with its midpoint and 95% interval, authored by one scientist and reviewed by another.
  4. The vial. In inventory, the Vero E6 working-bank vial at passage 12, in Box A2, recorded as thawed for that run.

What it does

  • One record per cell line. Spellings that differ only in spaces, case or punctuation are the same record, and one RRID can't name two lines.
  • The cell line is picked, not typed, frozen when the plate is made, and covered by the signature.
  • Antiviral templates compute a selectivity index per row from the readings, never typed into the table. This is built and tested but isn't on demo yet.
  • A plate template can carry a 96- or 384-well map: each sample with its compound and concentration, and the positive, negative and blank controls. Each plate shows its % inhibition and Z′, worked out from the signed readings, and a plate can be rejected with a reason. Demo has no example plate template yet.
  • Curves carry confidence intervals, stated no-calls and exclusions with reasons.
  • Titre units have one spelling each: PFU, FFU, TCID₅₀ and copies per mL, their log forms, and PFU per cell.
  • Cell-bank vials carry passage and bank, and count thaws.
Where it stops
  • This is a foundation for antiviral work, not a full antiviral platform yet.
  • There's no virus record type yet.
  • No titre arithmetic yet: no TCID₅₀ by Reed–Muench or Spearman–Kärber, and no plaque counts to PFU/mL.
  • No plate-reader file import. Plate readings are typed, pasted or uploaded as a spreadsheet.
Paths Through SmartBook3 / 11 · Virology
ChemistryFor the head of chemistry

One record per molecule, checked the moment it's drawn.

Structures, lots and reactions show their arithmetic, and nobody needs a ChemDraw seat to register a compound.

Take the guided tour →No ChemDraw? No problem! →

The walk on demo

  1. The compound. SMP-B0001: structure, InChIKey and SMILES; who recorded it and from what; calculated values (MW 251.29, cLogP 1.79, QED 0.87, no PAINS or Brenk alerts) beside measured potency.
  2. Its lots. L001 at 98.6% and L002 at 97.9%, in three containers. The stock calculator shows that 10 mM in 1 mL needs about 2.55 mg, corrected for purity, with the working shown. L001's LCMS is on the lot: the original JCAMP-DX file, downloadable unchanged with its SHA-256, plotted on the page, and read by the chemist as confirming identity ([M+H]+ 252.1).
  3. The duplicate guard. Paste SMP-B0001's SMILES into New compound: "Already registered as SMP-B0001". Add ".Cl" and it offers a lot of SMP-B0001 instead. A systematic name converts to a structure offline.
  4. Structure search. A substructure search on the aminothiazole finds SMP-B0001 and the cephalosporins that share it. Export the set as an SD file, a spreadsheet (CSV) or a ChemDraw file (CDXML).
  5. The reaction. "SMP-B0001 amide coupling, batch 1": the scheme, each amount shown with its arithmetic, the acid named as the limiting reagent and the amine at 1.01 equivalents. The amine was measured by volume; its density (1.095 g/mL) was offered from the catalog record of the bottle it was drawn from and accepted by the chemist, and the table says where it came from. Each reactant is linked to its bottle. Lots L001 and L002 are recorded as made here, so the page works out the yield from them (10.9%, purity-corrected), and each lot's page says which experiment made it and what was drawn for it. Authored by Bin Liu and reviewed by Steven Boyd.

What it does

  • A duplicate structure, salt forms included, is refused with the existing record's name.
  • A suspicious drawing (a stray fragment, a charge with no counter-ion, a radical, an isotope label, a query atom, an unusual valence) is flagged with its atoms highlighted, and the checks your organization makes blocking need a reviewer's acceptance, with a reason, before the compound is registered.
  • Chemists draw in the browser. SD files and ChemDraw files import as reviewed proposals, with the originals kept.
  • Amounts are recomputed from what was weighed, inputs shown, and no limiting reagent is claimed while any reactant's amount can't be turned into moles. A density, purity, lot MW or concentration on file is offered, never applied until the chemist accepts it, and keeps its source.
  • Reagents are drawn from named containers and become part of the signed experiment.
  • The conditions sit over and under the arrow: reagents above; solvent, temperature and time below, each a number with a unit and each reagent its own record. They're part of what the signature covers.
  • A lot names the experiment that made it and the reactant lots and containers it came from; the experiment's yield is worked out from its lots, and naming a lot on a signed experiment is an amendment with a reason.
  • A lot's NMR, LCMS and HPLC files are kept exactly as the instrument wrote them; JCAMP-DX spectra are plotted on our own server, a reading of the file is recorded by a named person, and the lot's purity can cite the chromatogram it came from.
Where it stops
  • No lookup by trade name yet.
  • It isn't a publication drawing tool: one step per scheme, no special arrow types, and the ChemDraw-format export hasn't yet been checked in ChemDraw itself.
  • Substructure search reviews up to 2,000 candidates and says when it stops. SAR and MPO views cover up to 200 compounds.
  • Reaction schemes and experiments are an option per deployment. They're on for demo.
Paths Through SmartBook4 / 11 · Chemistry
The AI assistantFor research leadership

One question, across everything your lab has recorded.

The Lab Assistant reads across assays, compounds, strains, experiments, inventory and your documents at once. It draws the chart you ask for, drafts the summary, and builds the slide deck. It quotes SmartBook's own stored results instead of recalculating them, and nothing it makes joins the record until a named person checks and accepts it.

Take the guided tour →

The walk on demo

  1. Ask what you're looking at. On MIC run 1, press "What is this page?", then open "What the assistant saw": the table, the sorting, the badges on screen.
  2. Ask across the app. "Which isolates is SMP-B0001 weakest against, and how much SMP-B0001 do we have left?" It reads the panel's stored calls and the inventory together, shows each lookup as a step, and links every record and container it used.
  3. Ask for a chart. "Plot SMP-B0001's MIC by isolate against cefepime, ceftriaxone and ciprofloxacin." The chart appears in the conversation, ready to pin to a record.
  4. Ask a chemist's question. "Which compounds share SMP-B0001's aminothiazole, and how do their MICs compare?" It answers from the structures of record and the potency measured against them.
  5. See AI work accepted into a record. In run 1's Findings, the chart "MIC by isolate" reads "Accepted by Denis Daigle", with the model and version that made it.
  6. Build the deck. Ask for slides on MIC run 1 and download the PowerPoint: each table and chart is read from stored results, and each slide names the record and version it came from. Selected records make one too, from "Make a deck" on the selection bar.

What it can do

  • Charts and tables on demand, drawn from the data in front of it.
  • Answers that join the whole lab: assays, compounds, strains, experiments, groups, inventory and the document library, with a link to each record it used.
  • Science it reads rather than redoes: S/I/R calls, curve fits, synergy and time-kill results, and QC verdicts, each with the table or rule version it came from.
  • Every computed number shows its working: curve fits, checkerboard FICIs, time-kill calls, fold-potentiation, the derived ratios, reaction stoichiometry, the stock calculator, yield from lots, cross-run comparisons, compound identity, calculated properties, structural alerts, the eNTRy rules, S/I/R calls, QC acceptance, MIC50/MIC90, MIC distributions, the time-kill inoculum and dilution read-out, every table summary, every written formula, MPO scores, structure clustering, combination identity, the SAR table, activity cliffs, matched pairs and the structure checks each link to a methods page with the method and its formula, the library version in the running release, our own source code, and a reference check run on the page. The 4PL fit agrees with R's drc package on 18 of 18 values; compound identity keys match PubChem's InChIKeys exactly on 20 of 20, salts and enantiomers included; S/I/R calls match what EUCAST's notation defines on every row of the shipped EUCAST v16.1 table; MIC50 and MIC90 match the Dotmatics example workbook's own cells for all eight agents, and its hand-built distribution and Finlandogram tables are reproduced cell for cell with a live denominator; the others match examples worked by hand or published values. Each method is marked "awaiting human review" until someone in QA, or an administrator, records a review; none has been reviewed yet. Record exports and the workbook name the method and version behind each computed value.
  • Structure–activity questions, answered from the structures of record and their measured potency.
  • Summaries you can check: describe the summary you want, it proposes the calculation, and SmartBook does the arithmetic.
  • A slide deck across projects, from the assistant or a selection, in the shape you describe: every value and chart read from stored results, each slide naming its sources, and nothing on it you could not open yourself.
  • A guide on the live page: it walks you through a task by pointing at each control, and suggests the next question to ask about a table.
Why you can trust it
  • It shows what it saw and each step it took. It never reads passwords, hidden fields or the signing dialog.
  • It points; it never clicks, types or submits.
  • AI content on a record is marked, names its model, and waits for a named person to accept it. Then it's frozen.
  • Every record it opens for you is in the audit trail, under your name.
Where it stops
  • A chat reply isn't a record, and a chart's values are written by the model. That's why charts wait for a person to accept them.
  • It runs Anthropic's Claude model through Amazon's AI service (Bedrock), which may answer from any of Amazon's regions. On our demo, if Amazon turns a request away, it goes to Anthropic directly instead, unless it carries your QC ranges. Page 6 has what's sent and what's kept.
  • The organization switch turns chat and walkthroughs off. Dashboard summaries and document search still use the model. There's no way yet for other software to connect to it.
Paths Through SmartBook5 / 11 · The AI assistant
Your data and the AIFor whoever owns the data

What the AI sees, where it goes, and what's kept.

To draw your chart or run your analysis, the assistant has to read your numbers. They go to Anthropic's Claude model, running inside Amazon's AI service (Bedrock), for that one request. Amazon doesn't keep them, doesn't train on them, and doesn't hand them to Anthropic. Here's the whole path, and what isn't finished yet.

What does the AI actually see?

Your question; the text of the page you're on, but never passwords, hidden fields or the signing dialog; and whatever its lookups return, which is records and document passages from your organization, never another's. Under each answer you can open what it saw and every lookup it made, and each record it opens is in the audit trail under your name.

What happens when I ask for a chart or an analysis?

It looks the table up, and those numbers go to the model with your request. The model sends back a description of the chart, and your browser draws it. For a summary, it proposes the calculation and SmartBook does the arithmetic on its own server. Either one joins a record only when a named person accepts it.

Does Amazon or Anthropic keep it, or train on it?

No. Amazon says Bedrock stores no inputs or outputs by default, that no operator of the service can see them, and that it doesn't train any model on them or share them with the model's maker. Claude runs in accounts Amazon owns and operates, which Anthropic can't reach. Amazon does keep traffic for up to 30 days for a short list of models, Anthropic's newest (Fable) among them. SmartBook doesn't use those, and won't switch to one without telling you.

Where is it processed?

Each request enters Bedrock in the region SmartBook runs in. To keep answers fast, Amazon may do the work in another of its regions anywhere in the world, carried over its own encrypted network rather than the public internet, and its log of the call names the region that did it. Keeping the work inside the US or the EU is designed but not built yet.

What does SmartBook itself keep?

Your conversations, the page text the assistant saw on each turn, and any answer you rate, in your SmartBook database behind the same walls and encryption as your records. For cost, it counts the words in and out, not what they said. Bedrock's optional logging of prompts isn't switched on. If the assistant fails, our bug report says what broke, never your question or your data.

Can we keep it in our own account, or turn it off?

Run SmartBook in your own Amazon account and every AI call is made by that account, under your agreement with Amazon, on your bill, and listed in your own AWS CloudTrail log. An administrator can switch the assistant off for the whole organization. Today that stops chat and walkthroughs, but not the features that read your data in the background, such as document search, dashboard summaries and the spreadsheet and QC workbook readers.

Who receives what

WhoWhat they get, and what they keep
Amazon Bedrock, running ClaudeYour question, the page text and what the assistant looked up, for the length of one request. Not stored, not trained on.
Anthropic, the company that makes ClaudeNothing, through Bedrock. Only our demo falls back to Anthropic's own service when Amazon refuses a request; production has the fallback off. Even on our demo, a conversation that has read your QC ranges, and the triage of a bug report, never fall back.
Amazon Bedrock, reading a spreadsheet you importThe column headers and the first ten rows of a strain spreadsheet, so Claude can suggest how to read it, for the length of one request. You confirm every suggestion. This request never falls back to Anthropic's own service.
Amazon Bedrock, reading a QC workbook you uploadIts labels and layout: the file and sheet names, each block's banner, the strain column headers, the agent row names, and which cells the code flagged and why. Never a range value. With them go the QC strain IDs and agent names already in your workspace, so Claude can suggest how to read it, for the length of one request. You accept or reject each suggestion. This request never falls back to Anthropic's own service, and neither does any conversation with the assistant that has read your QC ranges, on a QC page, a QC proposal or through a lookup, from then on.
Amazon Bedrock, sorting a bug report you fileWhat you wrote, the page it came from and a short summary of what you'd just done; for a thumbs-down, your question and the reply you marked. The model sorts it for our team, for the length of one request. This request never falls back to Anthropic's own service, and the organization's assistant switch stops it.
Amazon Bedrock, for document searchPassages of the documents you upload, turned into a search index by an Amazon model in SmartBook's own region. The index is stored in your database.
EMBL-EBI's public ChEMBL databaseThe structure key (InChIKey) of a published reference compound, such as cefepime, to fetch its public data. Never one of your own compounds. Off in production unless you turn it on.
Us, at SmartBookIf we host it, our engineers can reach the servers (page 9). If you'd rather we couldn't, run it in your own Amazon account.
Where it stops
  • On our demo, a request Amazon turns away goes to Anthropic's own service, which by default doesn't train on business customers' data but does keep requests for a limited time. Production has this off, and the demo holds made-up data only. A conversation that has read QC ranges, and a bug report's triage, go only to Amazon, even on the demo.
  • The work isn't pinned to one country or region yet.
  • The organization switch doesn't yet stop background features, such as document search, dashboard summaries and the spreadsheet and QC workbook readers, from using the model.
  • A chart's values are written by the model, which is why charts wait for a person to check and accept them.

Amazon's own wording is on its Bedrock user guide's data protection, abuse detection and cross-Region inference pages and in the Bedrock FAQ, checked October 2026. Your IT team can confirm the regions and the calls in their own account's logs, and we'll send them our data-flow map.

Paths Through SmartBook6 / 11 · Your data and the AI
InventoryFor lab operations

Every vial in one place, every use against a record.

Stock is deducted by the person at the bench, against the record it was used for, in a ledger that checks itself every night.

Take the guided tour →

The walk on demo

  1. Where things live. Spring Mill R&D building, down to Reagent shelf B in Chemistry Lab 2 and to Box A1 in Freezer F1 (−80 °C).
  2. The box. Box A1 is a 9×9 map with each container and its barcode. Print a label sheet for it.
  3. Scan a code. Type or scan a vial's code in the top bar. It opens the container, its amount, its place and its receipt.
  4. Ask where it is. "Where is…?" SMP-B0001 lists three containers, with code, amount and slot.
  5. Follow a draw. The HATU bottle's ledger: received 25 g, then 4.18 g used for the amide coupling, linked into the signed experiment.
  6. Record a use. Signed in as a scientist (cassandra.chatwin, say), draw 20 µL of the stock solution on the unsigned dose-response assay. Ask for more than is left, and it's refused. An administrator's login can't do this: in Spring Mill, administration and bench work are kept apart.
  7. See an alert. The alerts page lists HATU below its minimum of two containers, and a bottle of medium that expires within three weeks.
  8. The whole stock, flat. Stock: every container, antibiotics and materials together, in one sortable table in the lab's own columns. A row's ⋮ menu, or a right-click, uses, moves, re-dates or disposes of it in place: a scientist uses, moves and disposes, QA or an administrator re-dates, and whatever a login can't do shows greyed out, with the reason. Select several rows and move, re-date or dispose of them together: one entry with one reason, all of it or none of it, undone as one. Export to Excel gives it back in the lab's own workbook layout, and an administrator can rebuild the inventory from it.

What it does

  • One container per slot. A taken slot is refused, naming what holds it.
  • Barcodes carry a check digit and are never reused. Labels print on Avery or thermal stock, and any ordinary USB barcode scanner works.
  • A use becomes part of the record's signed content. Expired stock needs a reason, and quarantined stock is blocked.
  • Every movement is written to a ledger that can only be added to, each line sealed to the one before, and a nightly check confirms the ledger still adds up to every stored amount.
Where it stops
  • Labels print through the browser. There's no printer driver or label language.
  • No phone-camera scanning, and no automatic deduction from reaction amounts. The second is deliberate: the chemist confirms each draw.
  • Alerts appear in the app, from a daily run. No email or paging yet.
  • No purchasing, temperature monitoring or LIMS links.
Paths Through SmartBook7 / 11 · Inventory
Quality & complianceFor QA

Audit us before the first call.

The audit trail, every earlier version and every signature can only be added to, never edited, and the database itself enforces it. Our clause-by-clause Part 11 mapping is public, gaps included.

Take the guided tour →

The walk on demo

  1. Correct a cell. As the scientist, change a reading on the unsigned run. History shows the old and new values, who and when. §11.10(e)
  2. Sign. The first signing of the session asks for username and password, plus a two-step code if you use one. The panel shows name, time and meaning. §11.50 §11.200(a)(1)
  3. Amend. Change another reading: a reason is required, the earlier signature reads "amended since", and re-signing takes the password alone. §11.70
  4. Copy it. The record PDF holds each signature beside what it signed, every version, the audit trail, and a verification code (with a QR code) that proves the copy hasn't been altered. §11.10(b)
  5. Review as QA. Review by exception lists changes to signed records, signatures outside working hours and bulk changes. Verify the chain, then sign the review. Annex 11 §9
  6. Inspect. As the auditor, everything is readable and nothing is writable. End on the public Part 11 mapping.

What it does

  • 63 kinds of record can't be edited or deleted at all, and it's the database that refuses, not just the software. For IT: PostgreSQL triggers block UPDATE, DELETE and TRUNCATE.
  • Each audit entry is sealed to the one before it within about a minute (a SHA-256 hash chain). An hourly check alerts QA and administrators to any break, and nothing quietly repairs itself.
  • Every change to a project, experiment, assay and its data tables, compound, lot, strain, cell line, procedure, request or blocker keeps field-level before and after values, who, when and why. A change to a signed record needs a reason.
  • A signature is bound to a version and a fingerprint of its content, signed content is locked in the database, and the author can't also review or witness. An approval signs the revision the approver read: if someone revises the proposal while the page is open, the decision is refused and nothing is applied.
  • Before anyone's first signature they accept, in the app, that it is their legally binding signature. The account menu says whether they have, and the dashboard asks anyone who can sign to do it first.
  • Installation and operational qualification (IQ/OQ) checks run on your own installation, with a performance qualification (PQ) template.
Where it stops
  • Records outside those 63 kinds are editable rows. The application keeps the history of the records named above and locks signed content.
  • Configuration (assay templates, table recipes, import mappings, breakpoint and approval settings), labs, teams and memberships, and instrument bookings are not yet versioned field by field.
  • Someone holding the database's master password could switch those protections off, until the software runs under a separate, more limited account. The audit seal isn't yet copied anywhere outside the database.
  • A signed notebook entry can't be amended yet.
  • No trusted third-party timestamps, and no disaster-recovery drill yet.
Paths Through SmartBook8 / 11 · Quality & compliance
CybersecurityFor scientists, in plain terms

Is my data safe? The plain answer.

In production, your records are walled off to your organization, encrypted where they're stored and while they travel, and every change, signature and export is written down for good. Here's how, who it protects you from, and what isn't finished yet.

Take the guided tour →

Who can see my data?

Only people in your organization, each with the role your administrator gives them. Someone from another company using SmartBook gets "not found", even with a guessed link. Changes, signatures and exports are all recorded with who and when, and nobody can edit that record, administrators included.

How does it know it's really me?

You sign in with your institution's own login, or with a password plus a six-digit code from an app on your phone. Repeated wrong guesses lock the account for a while, an idle session signs itself out, and your organization can allow sign-in only from its own network. Signing a record asks for your password again.

What does "encrypted" mean here?

Stored data is scrambled with a key, so without the key a stolen disk is unreadable noise. The key is kept in a hardware vault that Amazon runs (AWS KMS) and is changed automatically every year. Between your browser and SmartBook, data travels over HTTPS, the same protection your bank uses.

Why the cloud, rather than a server down the hall?

A server down the hall depends on one person to patch it, one power supply and one backup drive. A cloud data center has guards, backup power and people whose whole job is that building. In production, the database keeps a live copy in a second building and takes automatic backups, and a change to a record becomes a new version with the old one kept.

It runs on Amazon's computers. Can Amazon see or take my data?

Amazon runs the buildings and the machines; it doesn't get your data in readable form. Amazon designs its key vault so that nobody, its own staff included, can take a key out of it, and its published terms say it doesn't access customer content except to run the service or when the law requires. Amazon's data centers are independently audited (SOC 2, ISO 27001). If your organization runs SmartBook in its own Amazon account, the key is yours and your IT team decides who may use it.

And the AI assistant?

When you ask it something, your question and the page you're looking at go to the Claude model to compose an answer. It never sees passwords or the signing dialog, and its answers aren't part of your record unless a named person accepts them. Page 6 says exactly what's sent, where it goes and what's kept.

From whom?

WhoWhat stops them
Someone guessing passwords from the internetTwo-step codes, lockouts after repeated failures, and an optional allow-list of your own networks.
Another company using SmartBookEvery record belongs to one organization, and another organization's links answer "not found".
A colleague without the right roleRoles limit what each person can do; QA and auditors can read but not change or sign.
A lost or stolen laptopYour records live on SmartBook's servers, not on the laptop, and an idle session signs itself out.
A thief with a stolen diskEncrypted data is noise without the key, which stays in the vault.
Amazon's own staffNo readable copy and no extractable key, by Amazon's design; or your own Amazon account and key, if you prefer.
Us, at SmartBookIf we host it, our engineers can reach the servers to keep them running. If you'd rather nobody outside your organization holds the key, run it in your own Amazon account.
Where it stops
  • The production setup described here is fully designed and written as code, but not switched on yet. Today's demo is a public sandbox with made-up data and one shared password. Don't put real data in it.
  • No independent security audit (SOC 2) or outside penetration test yet. We tested it ourselves and will share every open item.
  • Uploaded files aren't scanned for viruses yet.
  • Everything runs in one Amazon region, and a full disaster-recovery rehearsal hasn't been done yet.

Your IT or security team will want the details. We'll send them the architecture, our security readiness assessment and the list of open items.

Paths Through SmartBook9 / 11 · Cybersecurity
Always upFor IT and whoever answers for downtime

Is it up? It tells you, and it keeps count.

SmartBook checks itself every minute and keeps every reading on a record nobody can edit, so its availability is measured, not claimed. When something fails, QA and administrators are told, and the first steps to fix it are on the same screen as the problem.

Take the guided tour →

The walk on demo

  1. Open Status. As anyone, the status page says whether SmartBook is up and how it has done against its 99.9% target over the last day, week and month. Annex 11 §16
  2. Read the budget. Minutes up, minutes down, and the error budget left. Planned downtime counts: a deploy that drops requests spends minutes like any other outage.
  3. Look at the parts. As QA: the database, the cache that holds sign-ins, the web server and the disk, each with its last reading, and the first steps beside anything failing.
  4. Check the checks. Every scheduled integrity check, from the audit-trail seal to file fixity, with when it last succeeded. One that stops running shows as overdue.
  5. Read the outages. Every outage of the last 30 days: when it began, how long it lasted, and what failed. Annex 11 §13
  6. Ask the assistant. It reads the page and walks you through the first steps. It can advise; it can't restart, change or deploy anything.

What it does

  • Every minute it checks the database, the cache, the web server over the internal network, and free disk space. Each reading is stored where the database refuses to edit or delete it, so a bad month can't be tidied up afterwards.
  • A minute with no reading counts as down. If the checks stop running, that's an outage, not silence.
  • Three failed minutes in a row alert QA and administrators in the app, once rather than every minute. Low disk warns without counting as downtime.
  • The scheduled integrity checks are watched for lateness too: a check that quietly stops looks exactly like one that finds nothing.
  • Updates are built to keep serving. The database update runs before the new version takes over, the web proxy holds requests for up to 30 seconds while it restarts instead of showing an error, and a container that stops answering is restarted on its own.
Where it stops
  • New in October 2026: demo shows it from its next update.
  • Demo is one server in one data center, so 99.9% is the target it's measured against, not a guarantee. 99.99%, about four minutes a month, needs a second server in a second data center behind a load balancer. That's designed, and it's a cost decision.
  • If the whole server goes down, the outage is seen afterwards, as a gap in the readings. No outside check pages anyone yet.
  • Outages shorter than about two minutes can go unseen.
Paths Through SmartBook10 / 11 · Always up
Bailing outFor whoever signs the contract

Leaving should take one click.

Your data isn't a hostage. Any member can take the whole workspace as a spreadsheet today. QA can take everything, including files, signatures, history and the audit trail, in an open format, with no ticket, no quote and no call to us.

Take the guided tour →

The walk on demo

  1. Open Export. As the scientist, Export at the top of every page offers the Excel workbook, which is open to every member.
  2. Read the workbook. "About this export" first. Compounds come with SMILES, InChIKey and names instead of codes, and a MIC sheet keeps ">64" exactly as typed.
  3. Copy one record. On the signed MIC run, export the record PDF: each signature and whether it still matches, and a verification code (with a QR code) that anyone can check against the machine-readable copy, without contacting us.
  4. Take your records with you. As QA, Export also prepares the full archive (.eln) on the server: a folder per record, notebook entries included, data tables as CSV, every attached file, and the audit trail. When it is ready, download it from the Exports page, as often as you need.
  5. See it on the record. In Activity, the Exports view lists the archive you asked for and every download you just took, each marked prepared or downloaded.

What it does

  • One click, one workbook, a sheet per record type it carries and one per data table, retired records included. Numbers stay numbers, ">128" stays as typed, and text that looks like a formula stays text.
  • The full archive uses an open, published format (RO-Crate) that other systems can read: every project, experiment, assay, compound, lot, strain, cell line, request and notebook entry with its history, signatures and comments, and every file checked against the fingerprint taken when it was uploaded.
  • Each archive lists the SHA-256 of every file inside it (manifest-sha256.txt) and shows its own SHA-256, so anyone can check a copy with standard tools, without SmartBook.
  • Leaving is on the record. Each export writes its audit event before anything is sent, and nothing downloads if that write fails.
  • The full archive is restricted on the server to QA, Lab Admin, Org Admin and Auditor, and to those who can see the whole workspace.
Where it stops
  • The workbook holds each record as it stands now, with every saved version of notebook entries but no other version history, and without files or the audit trail.
  • The archive is checked against the format's rules, but hasn't yet been imported into another running ELN.
  • Neither file yet carries assay templates, procedures (SOPs), breakpoint tables, signing workflows, approval requests, training records, who holds which role, the instrument register and its calibration log, legal holds, gene calls, or tables read from images.
  • Personal documents and chat conversations aren't exported, and the PDF isn't digitally signed.
  • On the compliance tier, stored files can't be deleted until their retention period ends, even after the contract does.
Paths Through SmartBook11 / 11 · Bailing out