Security
Security & privacy
Your data, protected
Liragen Insights handles your sequencing data with care. This page is a general overview of how we protect it and the terms under which we process it.
General overview — not a contract. Our data processing commitments are in the Data processing section of our Terms of Service. For specific compliance requirements, contact us.
Our commitments
How we protect your data
Your data stays yours
You retain ownership of the data you upload and the results we generate. We don’t sell it, and we don’t use it to train third-party models.
Encrypted in transit
All traffic to and from the platform is served over HTTPS/TLS.
Access controls
Individual accounts with hashed passwords (never stored in plaintext), rate limiting, and server-side sessions. Access is scoped to your own projects.
Secure hosting
Data is stored in an access-controlled environment; access is limited to authorized personnel for operating and supporting the service.
Isolated projects
Each user’s projects and uploaded files are kept separate from others’.
Deletion on request
You can request export or deletion of your projects and data at any time.
How your data flows
From upload to results
- 1
Upload
You upload sequencing data to your own per-project space, or point us at a public NCBI accession.
- 2
Process
The pipeline runs in the secured environment; only you and authorized operators can access your project.
- 3
Explore
Results are available to you in the browser and for download. Nothing is shared publicly.
For institutions & enterprise
Additional controls on request
SSO / SAML
Single sign-on for team and institutional accounts.
On-prem / private cloud
Deploy within your own infrastructure or a dedicated private environment.
Compliance discussions
Contact us to review your institutional or regulatory requirements.
For partners & procurement
Questions a procurement form asks
Written plainly, including where the answer is “not yet”. If you are reselling Insights to your own customers, you need to be able to repeat these to them.
Is there a contractual uptime SLA?
Not during the free-trial period. The Service is operated on a best-effort basis and we do not currently commit to a contractual availability figure. Partners on a signed agreement get a defined response commitment for tier-2 issues — pipeline failures, platform defects, data problems. If a specific availability target is a procurement requirement for you, raise it before signing and we will tell you honestly whether we can meet it.
How are incidents communicated?
By email to the account contact, and to the named technical contact for partners. We tell you what happened, what data was involved, and what we changed. We would rather send a short message early than a polished one late.
Is a Data Processing Agreement available?
Yes — ask us and we will send one. Your customers retain ownership of their data and results. We do not sell data, and we do not use it to train third-party models.
Who else processes our data?
We maintain a sub-processor list and will share it under the DPA. Ask before you sign rather than after — if a particular provider is unacceptable to your institution, that is a conversation worth having early.
Are you ISO 27001 or SOC 2 certified?
No. We hold no third-party security certification today and we would rather say so than imply otherwise. What we can do is answer specific control questions, support SSO/SAML, and deploy into your own infrastructure if that is what your policy requires.
Can we deploy it ourselves?
Yes. On-prem and private-cloud deployment are available, which is the usual answer where data cannot leave an institution. See the partner programme for how that works commercially.
Your rights & contact
Retention, requests & disclosure
How long do you keep my data?
We keep uploaded data and results only as long as needed to run the Service. Our policy is to retain them for around 120 days. Need them kept for a set period, or removed sooner? Just ask — you can request deletion at any time and we’ll remove them.
Can I upload human subject data?
The Service is built for de-identified research data. Please don’t upload data that directly identifies an individual, or protected health information under HIPAA — we don’t act as a HIPAA business associate. You’re responsible for de-identifying samples and holding any ethics or IRB approvals your institution requires. See our Privacy Policy for detail.
Can I get my data out?
Yes — result files are downloadable, and you can request a full export.
Do you share my data?
We never sell it. We share it only with the service providers who help us run the platform, with the organization that gave you access if you reached us through a partner, when the law requires it, or in connection with a business transfer. Our Privacy Policy sets this out in full.
How do I report a security issue?
Email contactus@liragen.com and we’ll respond promptly. Please don’t publicly disclose until we’ve had a chance to address it.
Questions about security or compliance?
We’re happy to walk through our practices with you.