Implemented preview controls
A bounded account of controls visible in the current service configuration, with no certification or compliance claims.
The deployment configuration places the public apps behind an HTTPS reverse proxy and binds the PharmCode service to loopback. Responses set baseline browser hardening headers against framing, content-type sniffing, broad referrer disclosure, and unneeded browser permissions.
PharmFast fit-job metadata and downloads are tied to an HttpOnly, SameSite=Lax session cookie; a job identifier alone is not treated as authorization, and custom PharmFast dataset uploads remain disabled. PharmPrep source and output files use temporary storage outside the public web root, keyed by UUID and tied to the browser session.
PharmPrep accepts one deidentified CSV, TXT, or TSV file up to 750 KiB and applies only the explicit column mapping selected in the interface. It does not use Bedrock or generated Python for conversion, and unsupported or ambiguous data is refused instead of guessed.
The server validates the exact deck and bundled dataset before admitting a fit. Unsupported or malformed inputs are expected to return a specific refusal, and the interface must preserve that reason rather than present a generic success.
AI4Pharma does not claim that this public preview is HIPAA-compliant, GxP-validated, SOC 2 certified, penetration-tested, or approved for confidential sponsor data. A Content Security Policy is not yet enforced and remains a private-pilot hardening gate. Those controls and evidence must be evaluated explicitly before a private pilot.