Security
Data boundaries declared from the first deployment.
The public environment is a demonstration. Accepting real genetic data requires a separate security and compliance release.
Explicit confirmation of public or synthetic data before every upload.
Rejection of disallowed or oversized files before any signed URL is issued.
Storage credentials kept server-side only; signed URLs valid for 15 and 5 minutes.
Sessions with HttpOnly cookies, CSRF protection, restricted CORS and rate limits.
Organization scope on every query and audit events without sensitive content.
7-day retention with automatic cleanup and user-initiated deletion.
Structured logs with no passwords, tokens, signed URLs or variant rows.
Requirements for clinical dataApproved encryption, backups, access control, incident response, data processing terms, legal review and institutional approval. All of this is out of scope for this release.