How we protect your data
Your data stays yours
No selling your data
We will never sell or monetize your research data.
No ad sharing or profiling
We never share your data with advertisers or use it to profile you. The only third parties involved are the vetted providers we rely on to run the service, such as cloud hosting, bound by contract to use it solely on our behalf.
No AI training on your data
We don’t use your images or research data to train our models.
No third-party trackers
Our website sets no advertising or analytics tracking cookies. We measure traffic from our own server logs instead.
Full export
You can export your data anytime in standard, open formats.
The questions your IT reviewer will ask
- Is my data encrypted?
- Yes. TLS on every connection to Conspecta, and AES-256 on everything we store: files, images, and records alike.
- Can another lab see my project?
- No. Each project’s data is separated at the database level, and an access policy runs on every single query.
- Who on my team can see what?
- Only the projects they’re on. You assign roles and set permissions project by project.
- Can I protect my account with two-factor authentication?
- Yes. Any standard authenticator app works, and handing a team to someone else asks for your password and code again.
- Can you restore my data if something goes wrong?
- Yes. Everything is backed up automatically, and we can restore it to an earlier point.
- What happens to data I delete?
- It waits in Trash for 30 days. Then it goes for good. A team whose plan ends keeps its data for 90 days, which leaves time to export it or reactivate.
- Where does my data physically live?
- In the United States. Amazon Web Services is the only provider that stores your research, in a US region. Billing and push notifications reach US-based providers too, and we will send the full subprocessor list on request.
- Who is watching for an attack?
- We are. Our infrastructure is checked continuously for unusual API calls, network traffic, and storage access. Anything high-severity reaches us immediately.
Compliance
SOC 2 / ISO 27001
Our controls follow the SOC 2 Trust Services Criteria and run today. There is no audit report yet. When a contract needs one, we engage an auditor for a Type I, which reports on a single point in time. ISO 27001 covers the same controls, and we can pursue it instead if your review requires it.
HIPAA / PHI
Most discovery and preclinical work does not involve PHI, and our standard terms exclude it. Identifiable patient data needs a BAA, which is quoted with a Business plan. Talk to us before you upload anything covered.
21 CFR Part 11 / GxP
Notes, protocols, and sequences in Genetics carry version history. Changes are logged with who made them and when, and the log can’t be edited. Sign-offs record who approved what and show when the record has changed since, and protocol runs keep a step-by-step trail. A Business engagement validates Conspecta against your workflow and adds the signature controls Part 11 requires.
GDPR
Followed on every plan. You can access, export, correct, and delete your data, and we don’t sell it or use it for advertising.
EU / non-US data residency
Data is stored and processed in the United States, with Standard Contractual Clauses for EU transfers. Another region is a Business conversation.
On-premises / offline use
Conspecta is cloud-only and runs in the browser. There’s no self-hosted or on-premises install and no offline desktop mode, and that won’t change: we can’t secure, patch, or stand behind a deployment we don’t run. If your policy requires software on your own servers, we’re genuinely not your fit.
What we can send your security team
Security questionnaire response
A written answer to how we handle encryption, access control, tenant isolation, and incident response. Enough for most vendor-review checklists.
Subprocessor list
Every third party that touches your data, what they do, and what reaches them.
Breach-notification terms
What we commit to telling you, and how fast, if your data is ever affected.
Our cloud provider’s audit report
Amazon Web Services’ SOC 3, which covers the data centers and infrastructure Conspecta runs on.
If your review needs its own form filled in, a call with us, or evidence pulled from our live systems, that’s part of a Business plan.
Need SOC 2, or a security review?
Tell us what your review asks for and we’ll scope it with you.