Security
Background
The Experimental Design Assistant (EDA; https://eda.nc3rs.org.uk) was developed as part of the NC3Rs programme to support high standards in the use of animals. The software was commissioned by the NC3Rs following a competitive tender process; the contract was awarded to Certus Technologies Ltd. The EDA is supported by an EDA team comprised of Certus and NC3Rs employees.
The EDA is a web based system securely delivered via the public internet over HTTPS. The system comprises a set of software components operated entirely using a modern JavaScript enabled web browser, making it operating system and platform independent.
Storing information
Public users store their account profile and optionally their project data on the system. Only minimal information is required in the account profile: a user-chosen username, email address and password. Sharing of project data is facilitated via email address.
Experimental designs, in the form of EDA diagrams, can optionally be held by the system or exported to and imported from the user's local data store. In the latter case, no footprint is left in the EDA database.
The process is as follows:
- the user creates a new experiment
- the user populates the experiment diagram and, at any time, can export it to their own file system
- the user critiques the diagram to obtain feedback from the system; information will be sent to the server but held only in memory while the critique takes place
- to work on an existing diagram, the user will create a new experiment on the EDA and import a diagram into it from their own file system
Data protection
The Data Protection and Privacy policy, and Terms and Conditions of Use can be found on the following pages: https://eda.nc3rs.org.uk/privacy and https://eda.nc3rs.org.uk/terms-conditions. Both were developed under guidance from a leading international law firm.
The EDA systems run on a server housed in a secure data centre. User data is regularly backed up to a server in a second secure data centre. Both centres have been security checked, and the EDA system is regularly subjected to penetration testing conducted by an independent CESG Certified Cyber Security Consultancy (CCSC).
The EDA team can only routinely access diagrams which have been explicitly shared with them. Any access to the database itself is available only to the Certus development team and from its own computers, and is covered by Certus' Information Access Control Management procedure. Under this procedure, limited access can be granted to the database (and/or related backup files) by an Access Control Manager, but only for the purpose of carrying out an agreed support task. This access privilege is removed when the task is complete.
