Your signal, our custody, on your terms

Where

Your files and everything derived from them are stored and processed in Germany: object storage and databases in the Frankfurt region, decoding on our own hardware in Hamburg. One co-ordinating service, which holds no files, still runs in an EU region outside Germany and is moving to Frankfurt. Subprocessors are named in the annex to the AVV.

Where the material came from

We take data of EU, EEA, Swiss and UK provenance as standard, and other origins once your documentation is in place. Non-human biological material is very likely a genetic resource under the Nagoya Protocol; the obligations that carries are yours as its user, and our part is to perform only the service you ordered and to keep the record of where the material came from — so we ask for the paperwork before you upload, not after.

Provenance and permissions

How your data travels

• Upload over TLS with credentials scoped to your job only: they can write to your job's folder, nothing else, and they expire.
• Checksums: you send a checksum list; we verify every file and tell you what arrived. The header attributes of a signal file are removed on receipt, so the receipt gives two checksums per file: as you sent it and as we hold it.

Who can see it

The people running your job. No one else. Your data is used for your job and nothing else, unless you opt in — on the request form — to contribute anonymised signal to our cross-pore validation. That box is unchecked by default and stays that way unless you tick it.

When it is deleted

• Raw signal: 30 days after delivery
• Results: 90 days after delivery, or 12 months if you extend retention for repeat searches
• Earlier on request, any time
• You receive a deletion receipt
• Kept longer: origin documentation for genetic resources, ten years after your results are provided

That last one is the one exception. If your material is a genetic resource, the obligations under Regulation (EU) 511/2014 are yours as its user; what we keep is the record of where the material came from and who declared it, for ten years after your results are provided. It is stored apart from your data, it is never your signal or your results, and an early-deletion request does not reach it. Everything else on this page is unaffected.

Human-derived data

Research data of human origin is processed only under an AVV (data processing agreement under Art. 28 GDPR), pseudonymised before upload, for research use only. We provide the AVV template, based on the EU Commission's standard contractual clauses.

Patient specimens are not accepted.

AVV — data processing agreement

If your data cannot leave your institution

On-premise processing is available for institutions that cannot export data. Contact us. It is delivered as a bespoke project — individually scoped, individually quoted, agreed case by case. There is no standard offer, no price and no self-serve path, and what we agree with you is what happens to your data.

The audit record

Every job ships a signed JSON record: model identifiers and hashes, the codebook hash, your calibration ID if any, input and output checksums, signal sample counts, the thresholds of any search, the country of origin you gave us and the reference of any origin documentation held for it, the reference genome this job was aligned against and its checksum, retention dates, and the research-use attestation. Put it in your validation file; anyone can verify the signature independently.

What makes a rerun checkable Start a free Signal Check