Security & data stewardship
Research data deserves both protection and freedom. CollabHub is built around enforced access control, NIH/GDPR-ready data management and a guarantee that your data can always leave.
The open-export guarantee
Export everything, on every tier, forever — free. Tabular datasets leave in open formats — CSV, TSV, JSON, or XLSX — your uploaded files download as the originals you put in, and your privacy settings produce a full archive of your account records, notebook entries and their complete version history included. No export paywall, no lock-in, no exceptions. If you ever want to leave CollabHub, your data goes with you — see exactly what each export contains.
Account security
Strong defaults for every account, from a solo PI to a full lab.
- Multi-factor authentication
- Authenticator-app (TOTP) codes with QR or manual setup and single-use recovery codes, managed from your security settings.
- Password protections
- An enforced password policy, lockout after repeated failed attempts, and every session signed out when you change your password.
- Session management
- See your active sessions with device details and revoke any of them, or sign out everywhere at once.
Enterprise access control
Bring your institution's identity provider; access follows your directory.
- Single sign-on (SAML and OIDC)
- SP-initiated and IdP-initiated single sign-on over SAML or OIDC, so your institution controls authentication.
- SCIM provisioning
- Add and remove users automatically from your directory. People who leave lose access as soon as your identity provider says so.
- Role-based access, enforced at the API
- Owner, Admin and Member roles in the organization, and Owner, Editor, Commenter and Viewer in each workspace. Roles are checked on every request, not just hidden in the interface.
Data location
Where your data is stored, stated plainly.
- Where your data is stored
- Your data is stored at rest in the European Union, on infrastructure provided by Contabo GmbH.
- Fail-closed region handling
- If an operation can't determine its region, it stops rather than defaulting to another region.
Privacy and GDPR
Self-serve rights, not a support-ticket queue.
- Export your data
- Download a full archive of your account records — including your notebook entries with their complete version history — from your privacy settings at any time. GDPR portability, on every tier.
- Delete your account
- Account deletion is self-serve and carried out end to end, including your content and personal data.
- Consent and transparency
- Granular consent controls and a clear view of how your data is processed, managed from your privacy settings.
Audit and compliance tooling
NIH/GDPR-ready records for reviews, audits and data-management plans.
- Audit logs
- Organization-level audit trails record who did what and when across your workspaces.
- DSAR register
- Track data-subject access requests for your organization from intake to completion.
- RoPA register
- Keep your Article 30 record of processing activities alongside the data it describes.
Questions or concerns?
Write to the right team directly. Our Privacy Policy and Data-Use Covenant set out how we handle your data.
- Report a security issue
Found a vulnerability? Tell us directly and we'll respond promptly.
- Privacy and data requests
Data access, export or deletion questions go to the privacy team.
- Institutional agreements
Security reviews, SSO and Enterprise terms for your institution.
Keep your lab’s records safe and portable
Every plan includes multi-factor authentication, enforced roles and the open-export guarantee.