# Security at ProteinIQ Last reviewed: September 28, 2026 Researchers upload unpublished sequences, candidate molecules, and structures to ProteinIQ, often long before that work is public. This page explains where that data goes, who can see it, how we protect it, and where our protections stop. It is meant to be read alongside our [privacy policy](https://proteiniq.io/legal/privacy) and [data processing agreement](https://proteiniq.io/legal/dpa), which are the binding documents. ProteinIQ is operated by Matic Broz s.p., a small company based in Slovenia. The summary below is what we commit to, and the sections after it explain how. If something you need is missing here, email [security@proteiniq.io](mailto:security@proteiniq.io) and ask. - GDPR compliant Access, export, correct, or delete your personal data, with a lawful basis for every use. - EU company Operated from Slovenia and governed by EU law, with GDPR as the baseline for every user. - Never used for training Your sequences, structures, results, and AI chats are never used to train models. - Isolated, encrypted compute Each job runs in its own sandbox. Data is encrypted in transit and at rest. - Full data ownership Everything you upload and generate stays yours. When you delete it, it's purged from our systems within 30 days. - Enterprise agreements DPA, security questionnaires, invoice billing, and purchase orders for institutions. ## Where your data lives The web application is hosted on Vercel. Account records, job metadata, and workspace settings are kept in a managed PostgreSQL database, and the files you upload and the results tools produce are kept in Cloudflare R2 object storage. All of these run in US East regions, and database backups stay in the same region. Every connection to ProteinIQ uses HTTPS, and the database and object storage are encrypted at rest by their providers. Many of our lighter tools, such as calculators, format converters, and sequence utilities, run entirely in your browser. When you use one of those, your input is processed on your own machine and is not sent to our servers unless you choose to save the result to your workspace. ## How jobs run Heavier tools like docking, structure prediction, and protein design run as compute jobs on Modal, in sandboxed containers that are separate from the web application and the database. Each tool has its own container image, a job receives only the inputs you submitted for it, and its outputs are written back to your workspace storage. Containers scale down shortly after the work is finished. The scientific software itself is the published, open source code from the original authors, pinned to a specific version. A few methods depend on a public scientific service as part of how they work. Structure predictors that build a multiple sequence alignment, such as [Boltz-2](https://proteiniq.io/app/boltz-2), Chai-1, OpenFold3, and AlphaFold2, send your protein sequences to the public ColabFold MSA server to build it. Protenix sends them to its developers' MSA server instead. Some of these tools generate the alignment by default, and [BioEmu](https://proteiniq.io/app/bioemu) always fetches one when you give it a sequence. To keep your sequences on ProteinIQ, upload a precomputed A3M alignment or turn MSA generation off in the tool's settings. Boltz-2 and LMI4Boltz can also use your own MSA server. Apart from these cases, we do not send your inputs to the tool authors or to anyone else as part of running a job. ## Who can see your work Everything you create belongs to a workspace. Jobs, files, and projects are private to that workspace by default. Within a shared workspace, access follows the member's role: owners and admins manage members and settings, members run and manage their own work, and viewers can look at results without running or changing anything. A job only becomes visible outside its workspace if someone in the workspace shares it. Sharing is set per job: you can invite specific people by email, open it to anyone signed in to ProteinIQ, or make it public, and you can switch it back to private at any time. Files are never served from public storage URLs. Every download or preview is checked against the job or file it belongs to before any bytes are sent, and the file is then streamed through the application or delivered through a short-lived signed link to that one object. On our side, access to production systems is limited to the people who operate the service, and we only look at customer data when it is needed to answer a support request you made, to investigate a failed job, or to deal with abuse or a security issue. ## Accounts, API keys, and payments Sign in and session management are handled by [Clerk](https://clerk.com/), so ProteinIQ never receives or stores your password. Payments are processed by Stripe. Card details are typed into Stripe's own secure payment fields and go directly to Stripe, so they never reach our servers. If you use the API, each key belongs to a workspace and carries a set of scopes that limit what it can do. We store only a hash of the secret, which means the full key is shown to you once when it is created and cannot be recovered later. Only workspace owners and admins can create keys, and they can revoke any key at any time. ## Protecting the application Each API route checks who is making the request and whether they have permission in the relevant workspace before it does anything. Request bodies are validated against schemas, and endpoints that are expensive or easy to abuse are rate limited. The site is served with HTTP Strict Transport Security, a Content Security Policy that restricts where scripts and connections can come from, and headers that stop other sites from framing ProteinIQ pages. We update dependencies regularly and treat changes to authentication, billing, and file access as the ones that need the closest review. ## AI features ProteinIQ has a few optional AI features: the AI Assistant, the agent in Studio, and generating workflows from a description. When you use one of them, your messages and whatever the feature needs to answer, such as sequences, files, or job results you point it at, are sent through OpenRouter to a third-party language model. We instruct OpenRouter to use only model providers that do not store your prompts or train on them. None of the scientific tools depend on these features. If you are working with data that must not leave ProteinIQ's own infrastructure, run the tools directly and keep that data out of AI conversations. ## What we do not do with your data We do not sell your data, and we do not use your sequences, structures, results, or AI conversations to train machine learning models. You keep full ownership of everything you upload and everything the tools produce from it. To understand how the site is used we rely on Vercel Analytics and Speed Insights, which count page views and measure load times without cookies. We also keep our own records of which tools are run and how jobs perform, because billing and support depend on them. ## Retention and deletion Job inputs, results, and files remain available until you delete them or delete the workspace. We do not expire your work on a schedule. When you delete your account, your name, email address, and other identifiers are removed within 30 days, and your uploaded files and results are deleted from active systems. Copies that remain in backups are purged when those backups age out after 30 days. Billing and usage records are kept in anonymized form so that they can no longer be linked to you. The [privacy policy](https://proteiniq.io/legal/privacy) describes exactly what is deleted and what is anonymized. ## Compliance and subprocessors ProteinIQ is operated from the European Union and follows the GDPR. Our [data processing agreement](https://proteiniq.io/legal/dpa) covers institutional customers, relies on the EU–U.S. Data Privacy Framework or the Standard Contractual Clauses for transfers to the United States, lists every subprocessor we rely on, and commits us to notifying you without undue delay, and where feasible within 48 hours, of a breach that affects your personal data. We do not currently hold a SOC 2 report or an ISO 27001 certification, and we will not claim one until it can be verified. If your institution needs a completed security questionnaire or more detail about a specific control, email us and we will answer what we can. ## Reporting a vulnerability If you believe you have found a security issue in ProteinIQ, please email [security@proteiniq.io](mailto:security@proteiniq.io) with a description of the problem and the steps to reproduce it. Please test only against your own account and workspace, do not access or change other people's data, and avoid anything that degrades the service for other users. Give us a reasonable amount of time to fix the issue before you disclose it publicly. Our contact details are also published in machine-readable form at [security.txt](https://proteiniq.io/.well-known/security.txt). For anything else about how we handle your data, you can reach us at [privacy@proteiniq.io](mailto:privacy@proteiniq.io) or through the [contact page](https://proteiniq.io/contact). Our [terms of service](https://proteiniq.io/legal/terms) cover the rest of how the platform may be used.