BioRender Security Measures

Adherence to standards and industry practices
- BioRender performs services in line with professional and industry standards, skills, care, and diligence.
- Applicable supervisory guidance is followed for the design, maintenance, and operation of services.
- The security program aligns with NIST Cybersecurity Framework (NIST CSF) guidelines.
General security measures
- Information security: Internal controls protect confidentiality, integrity, and availability of information (including personal data), supported by a written, current security program and policies.
- Maintenance: Policies and the IT risk framework are periodically reviewed; risks from misuse, attacks, or failures are identified, assessed, mitigated, and monitored.
Physical security measures
- Facilities and access: Sub-processors secure data centers with 24/7 controls; BioRender secures non-public areas and systems with controlled access. Current sub-processors: biorender.com/sub-processors.
- Media protection: Procedures prevent unauthorized viewing, copying, alteration, or removal of media containing information assets.
- IT equipment protection: Environmental safeguards (e.g., fire prevention, power/AC redundancy) with annual inspections.
- Secure disposal: Media disposal follows NIST SP 800-88 “Purge” or “Destroy,” including redeployment/decommissioning, unless Customer authorizes alternatives.
- IT systems security: Secure configurations and hardening; clean-desk practices; no known vulnerabilities or default weaknesses.
Technical security measures
- Logical access controls
  - Policies govern granting, modifying, and revoking access; unique user IDs only; no shared accounts; least privilege.
  - Authentication controls and written password standards; enhanced admin controls; changes required upon admin departures.
  - Remote access is restricted and protected to prevent unauthorized use.
  - Monitoring for unauthorized access with timestamped, tamper-resistant audit trails; anti-malware protection and escalation.
- Data management controls
  - Personal data processed only per the Service Agreement.
  - Technical/organizational safeguards; encryption in transit and at rest.
  - Transfer destinations align with the Service Agreement.
  - Backup and recovery to ensure availability; backups protected to the level of source data.
  - Sensitive systems operate in isolated environments.
  - Regular vulnerability monitoring, patching, and change control.
- Network security
  - Only required network services enabled; unnecessary services blocked.
  - Managed/monitored Wi-Fi with strong encryption (e.g., WPA2/PSK); guest networks segregated.
  - Network partitioning with DMZs and firewalls for Internet-facing servers.
- Security monitoring
  - Log and event monitoring to identify and investigate incidents.
Organizational security measures
- Governance: Defined security roles and accountability.
- People controls: Staff are informed of obligations; reliability and integrity are assessed; background checks where legally permitted.
- Risk & audit: Periodic risk assessments and internal/external audits to verify compliance and drive remediation.
- Incident management: Documented response with investigation, containment, Customer notification/resolution (including destruction notification).
- Training: Role-based privacy/security training at onboarding and at regular intervals.
- Mobile device security: Centralized management, secure configurations, vulnerability protection, remote wipe, data segregation, secure connectivity, and controlled backup/sync.
- Secure development & websites: Documented SDLC, security/privacy reviews, testing (including penetration testing as appropriate); secure TLS, component monitoring, change testing, and compliant cookie/tracker use.
- Data quality: Controls to maintain accuracy/quality; timely updates propagated to subcontractors; extra protections for sensitive data where appropriate.
Periodic review of security measures
- Annual penetration tests with prompt remediation; results available upon request.
General privacy controls
- Support for assessments: Collaboration on DPIAs and Data Classification Reports (DCRs); implement relevant measures before services begin.
- Information provision: Detailed service and TOMs information provided for DPIAs/DCRs and related documents.
- Notice & consent: Release/change processes ensure Customer notices/consents remain accurate.
- Sub-processors: Due diligence, monitoring, and Article 28 contracts; encryption requirements where applicable; current list maintained (see Section 3).
- Privacy by design/default & minimization: Process only necessary data, for limited periods; use pseudonymization where feasible.
- No re-identification: Controls prevent re-identification of pseudonymized/anonymized data; no attempts to re-identify or disclose; separated keys/identifiers and access controls.
- Dataset combination: No combining with other datasets without controller authorization.
Responding to Customer concerns and audits
- Timely response to Customer concerns/audit findings; collaborate to address and resolve items.
Data retention
- Defined retention schedules; timely deletion of data no longer needed (including logs/temp files).
- Long-term/archival data stored in restricted systems.
- Formal, technically enforced retention/deletion process that is implemented, tested, and periodically reviewed.