Security & Data Handling
A technical one-pager for biotech IT reviewers, privacy-conscious users, and institutional compliance teams.
Bottom line: the BioProGuide tool is a single, self-contained JavaScript application. All scientific computation runs in your browser. Protein sequences, structures, and computed outputs are never transmitted to a server and are not stored anywhere outside your device's RAM for the duration of your session.
1. Architecture in one sentence
bioproguide.com is a static site hosted on Vercel. The tool at bioproguide.com/app is a single ~3.4 MB HTML file: everything (UI, models, solvers, plot generation, host registry) is delivered on first load and executed locally. There is no backend API that accepts sequence data.
2. What leaves your browser vs. what doesn't
Leaves your browser
- Standard HTTPS requests to Vercel to fetch the site (HTML, CSS, JS, images) — logged by Vercel per Section 6
- Fonts from Google Fonts (Inter) — one-time per browser cache
- Anonymous, cookie-less analytics ping (Plausible) — page views only
- One increment ping to Abacus when you click Predict my protein — no personal data, just a global counter
- Feedback form messages you type and submit yourself — via Formspree
Never leaves your browser
- Protein sequences you paste, type, or upload (FASTA)
- UniProt fetches, when used — response goes directly from UniProt to your browser, we never see it
- Predicted structures, plots, tables, and any computed outputs
- Host, formulation, and DSP recommendations
- Any parameter you enter, adjust, or export locally
3. What we specifically do not do
- No server-side sequence logging — there is no server that accepts sequences.
- No telemetry on tool usage patterns (no clicks, no page-time, no scroll depth).
- No cookies. None. Not for authentication, analytics, or personalisation.
- No
localStorageorIndexedDBwrites containing your sequences or results. - No CDN query-string logging of sensitive data — sequences are never in a URL.
- No advertising, retargeting, or cross-site tracking.
- No user accounts, no passwords, no OAuth, no email verification, no rate limits per identity.
4. Third-party services (complete list)
| Service | Role | Location | What it sees |
|---|---|---|---|
| Vercel Inc. | Static site hosting + CDN | USA (with EU edge nodes) | HTTP request metadata: IP, user agent, timestamp, requested URL path. Retained ≤30 days. No request body payloads (site is static). |
| Google Fonts | Serves the Inter typeface (WOFF2) | USA / global CDN | Font file request. IP address only. Cached in the browser after first load. |
| Plausible Analytics | Aggregate page-view analytics | Germany / EU (self-hosted EU infrastructure) | Page URL, referrer, country (from anonymised IP). No cookies. No cross-site profile. |
| Abacus (jasoncameron.dev) | Public click counter next to the Start button | USA | Incremented once per button click. No identifier, no personal data. Only a global integer. |
| Formspree Inc. | Handles the two feedback forms (Feedback tab only) | USA | Only what you type into the form: message content and optional email. Never triggered by tool usage. |
| Proton AG | Inbound email hosting for info@ / privacy@ / legal@ | Switzerland | Only emails you explicitly send. End-to-end encrypted where the sender's provider supports it. |
UniProt lookups (when you fetch a sequence by accession) go directly from your browser to rest.uniprot.org. We do not proxy or observe these requests.
5. How you can verify this yourself
Every claim on this page is checkable by anyone with a web browser:
- Open the tool at
bioproguide.com/app, then open your browser's DevTools → Network tab. - Enter a sequence, click through the whole flow, generate all outputs.
- Every outbound request will originate from the domains listed in Section 4 (Vercel, Google Fonts, Plausible, Abacus). No third-party domain will receive your sequence.
- UniProt-related requests, if you use that input method, will target
rest.uniprot.orgonly. - Right-click → View Source shows the entire application, including which fetch calls exist. Nothing runs server-side that we could hide.
6. Transport & storage security
- HTTPS everywhere. TLS 1.2+ enforced site-wide via Vercel. HTTP requests are redirected to HTTPS at the edge.
- HSTS enabled so browsers refuse insecure connections after first visit.
- No sensitive at-rest storage. The application does not write your sequences or results to
localStorage, cookies, or any browser database. Closing the tab discards your session state. - No backup of your session. If you want a copy of your run for your records, use the browser's Save Page As or print-to-PDF.
7. Suitability for regulated environments
BioProGuide is a research and educational tool. It is not a validated system for GMP, GLP, GCP, or any regulatory submission. Do not use it as the sole basis for clinical, regulatory, or manufacturing decisions. That said, for the purposes of a typical institutional IT / privacy review:
- GDPR: no personal data is collected on tool use; feedback forms are consent-based.
- HIPAA: not applicable — the tool is not designed for and should not receive Protected Health Information (PHI).
- Institutional data-classification: because sequences never leave the device, tool use is compatible with policies that prohibit uploading unpublished sequences to external services.
Trust boundaries we cannot cover: the security of your device (malware, browser extensions with page-access permissions, network operators intercepting traffic), users copying results into unsecured channels, and third-party downtime. These are outside our reach.
8. Contact for security-related questions
Security or privacy questions from institutional reviewers: privacy@bioproguide.com. Coordinated vulnerability disclosure: legal@bioproguide.com.