CERF is built on Java, Apache Tomcat, and standard SQL databases — technology your IT team already knows, already trusts, and already has policies for. It runs on your infrastructure, under your control, with no external dependencies, no cloud lock-in, and no surprises.
CERF is built entirely on open-source, industry-standard technologies — the same stack that runs enterprise applications across every major industry. There is no proprietary middleware, no vendor-locked runtime, and no component whose continued availability depends on the commercial fate of a single company.
The core stack is Java 25 (we recommend Eclipse Temurin), Apache Tomcat 11, and MySQL 9 by default. Apache ActiveMQ handles internal messaging and LibreOffice runs headlessly for document conversion. Every component is well-documented, widely understood, and supported by a large community.
If your organization already runs MariaDB, PostgreSQL, Microsoft SQL Server, or Oracle, CERF can use any of them in place of MySQL. The application layer is database-agnostic via JPA/Hibernate, and configuration templates are provided for all supported databases.
CERF supports three deployment models — cloud, on-premise, and sealed LAN — and is indifferent to which you choose. The application has no awareness of whether it is running on a cloud instance or a physical server in a basement. There is no "cloud edition" with extra features and no "enterprise tier" required to unlock on-premise deployment.
For organizations with strict data sovereignty requirements, CERF's sealed LAN deployment is the correct choice: the server has no required internet connectivity, holds no external license, and makes no outbound calls. Your data stays within your network perimeter, indefinitely.
For organizations that want Lab-Ally to handle hosting entirely, a managed AWS instance is available — giving you a fully supported, maintained server with none of the infrastructure burden on your team.
CERF's security architecture is designed for regulated environments — environments where "we trust everyone on the network" is not an acceptable security model. Access controls are enforced at every layer: network, application, workgroup, and individual record.
All client-server communication can be encrypted using HTTPS/TLS (SHA256 with RSA 2048). CERF supports LDAP integration, allowing organizations to authenticate users against their existing Active Directory or LDAP directory — eliminating the need to maintain a separate credential store and ensuring that user provisioning and deprovisioning follow your existing identity management processes.
CERF 6 adds optional TOTP multi-factor authentication for both the desktop client and the Automaton data ingestion tool, compatible with Google Authenticator, Microsoft Authenticator, and Bitwarden. MFA can be enforced selectively by administrators using Business Policy controls.
CERF's network architecture is straightforward: two ports open to the network, everything else bound to localhost. There is no complex mesh of exposed services to secure, no requirement to open database ports across network segments, and no dependency on external DNS, authentication, or processing services.
The CERF server communicates with clients over two configurable ports — 61616 (ActiveMQ) and either 8080 (HTTP) or 443 (HTTPS). The Tomcat web application server and Apache ActiveMQ are the only CERF components that need to be reachable from the network. MySQL and LibreOffice all communicate locally and should be explicitly excluded from external access in your firewall policy.
Integration with existing infrastructure is handled through LDAP for identity management, SMB for external file storage, and the CERF Automaton for automated instrument data ingestion — all configurable without programming.
CERF 6 is the first release to provide full native support across all three major desktop platforms for both the server and the client application. Windows, macOS, and Debian-based Linux workstations (including Ubuntu with GNOME desktop) are all fully supported — enabling seamless collaboration in mixed-platform environments without any platform-specific feature gaps.
The CERF desktop client is a Java Swing application that connects to the CERF server via HTTP or HTTPS on your designated port. It requires no browser dependency, no browser version management, and no web proxy configuration for standard deployments. Client updates are managed through the application itself and do not require IT involvement.
The CERF Web Administration Client is a lightweight browser-based interface for server administration tasks — accessible from any supported browser on the local network without requiring a separate installation.
Lab-Ally performs all CERF server installations remotely. Your IT team does not need to work through an installation guide or resolve configuration problems independently — a Lab-Ally technician handles the full installation process via Zoom (or similar) screen-sharing, with a member of your technical team available to grant access and make local network decisions.
Once installed, CERF requires minimal ongoing IT involvement. The application runs as standard system services, logs to standard locations, and backs up via standard database and file system backup tools. There is no background agent phoning home, no automatic update process that runs without your knowledge, and no external dependency that can silently change.
CERF is available with a perpetual license — a one-time purchase that gives your organization permanent, unconditional access to your CERF system and all your data, regardless of any future changes in your relationship with Lab-Ally. Annual subscription licensing is also available for organizations that prefer predictable operating expenditure.
Software updates are released approximately twice per year and are included in the standard support package. Updates are not automatic and are not forced — your organization decides when to apply them, in coordination with Lab-Ally. If an update is applied, Lab-Ally performs a full backup first and coordinates the process.
CERF has been in continuous production use for more than 20 years, built on open-source components specifically selected for long-term technological stability. While other ELN products have been acquired, sunset, or migrated to new architectures that broke existing deployments, CERF installations have continued to run on their original infrastructure.
For IT teams in regulated environments, one of the most significant hidden costs of ELN ownership is re-validation after vendor-imposed software updates. CERF eliminates this problem: updates are never automatic, never forced, and never required to keep the system running.
Organizations that have validated their CERF installation under 21 CFR Part 11 can elect to freeze it at that version indefinitely. Combined with a perpetual license, this means a validated CERF system can operate forever — on your infrastructure, under your control — with no re-validation burden and no ongoing vendor dependency.
Lab-Ally and qualified third-party validation specialists provide IQ/OQ documentation and services for new installations and for organizations updating from a previously validated version. CERF is designed to be validated in your specific deployment environment — the only approach that is truly defensible under 21 CFR Part 11.
The following tables summarise the software components installed by Lab-Ally during a CERF 6 deployment, and the network ports required for operation. Share these with your network team and security reviewers before installation.
| Component | Version / Notes |
|---|---|
| Java (JDK) | Java 25 — Eclipse Temurin recommended NEW |
| Apache Tomcat | Tomcat 11 — bundled, no separate install NEW |
| Database (default) | MySQL 9 NEW |
| Database (alt.) | MariaDB · PostgreSQL · SQL Server · Oracle |
| Apache ActiveMQ | ActiveMQ Classic 6.x — bundled NEW |
| LibreOffice | Headless, managed by CERF |
| CERF Server App | WAR deployed within Tomcat |
| CERF Desktop Client | Windows (.MSI) · macOS · Linux (Ubuntu with GNOME) NEW |
| CERF Web Admin | Browser-based — no installation required |
| Server License | Cryptographic file — tied to server MAC address |
| Port | Purpose & Exposure |
|---|---|
| 8080 | CERF HTTP client-server traffic. Open to network. Can be changed to any available port. |
| 443 | HTTPS/TLS — strongly recommended for any non-isolated network. Open to network. |
| 61616 | Apache ActiveMQ broker — internal CERF messaging only. Open to network. |
| 8100 | LibreOffice headless service — document conversion. localhost only — do not expose externally |
| 3306 | MySQL database — default configuration. localhost only — do not expose externally |
Only ports 61616, and 8080 or 443 need to be open to the network. LibreOffice and MySQL communicate on localhost only and must not be externally exposed. Lab-Ally reviews firewall requirements during the pre-installation call.
Talk to a Lab-Ally technician about your deployment requirements, network environment, and security policies. We can walk you through a live server demonstration and answer your IT team's technical questions directly.
Lab-Ally LLC · Columbus, Ohio · +1 (614) 407-4547 · cerf-notebook.com