Security & Trust

Private by Design, Yours by Contract

Your sequences are among your most valuable IP. Orbion is built so they stay private, never train our models, and remain entirely yours — and we put every part of that in writing for your IT and legal teams.

Request Our DPA Book a Security Review
Inference-Only EU-Hosted Full IP Ownership GDPR / DPA ISO 27001 In Progress

The promise

Three Commitments We Don't Move On

Everything below follows from these. If any one of them can't hold for your program, we'd rather tell you now.

Never Trained on Your Data

We run inference on your sequences. We don't train or fine-tune on your data, and nothing crosses between customers.

You Keep Your IP

Every prediction, construct, and result is yours. No royalties, no milestones, no claim on what you discover.

Hosted in the EU

Processed and stored on EU-based infrastructure, and removed on request or at the end of an engagement.

Follow the data

What Happens to a Sequence You Upload

One direction, four checkpoints. No step feeds your data back into our models, and every step has a safeguard your reviewers can name.

1 · You Upload

A sequence comes in over an encrypted connection.

Encrypted in Transit

2 · It's Isolated

It lands in your organization's own workspace, separated from every other customer.

Tenant-Isolated

3 · We Infer

Our models score it. It is never added to any training set.

Never Trained On

4 · You Get Results

Predictions and reports, encrypted at rest and exportable.

Yours to Keep

5 · You Can Delete

Removed on request or at the end of the engagement, with confirmation.

Deleted on Request

Encrypted In Transit And At Rest · EU Processing · Logical Tenant Isolation · Least-Privilege Internal Access

For your reviewers

Answers for the People Who Sign Off

Two teams usually gate a new vendor. Here's what each one needs — up front, before you have to ask.

For Your IT Team

Infrastructure, access, and controls

  • Encrypted In Transit (TLS) And At Rest
  • Hosted On EU-Based Cloud Infrastructure
  • Per-Organization, Logically Isolated Workspaces
  • Enterprise SSO (SAML / OIDC) On The Roadmap
  • Least-Privilege, Logged Internal Access
  • GDPR Breach-Notification Process

For Your Legal Team

Contracts, data protection, and IP

  • GDPR-Compliant DPA, With SCCs Where Relevant
  • Full IP Ownership — No Royalties Or Milestones
  • Sub-Processor Register Available On Request
  • EU Data Residency
  • Retention & Deletion Terms Set Out In The DPA
  • CDA / NDA Available Before You Upload

Where we stand

Certifications

What's in place today, and what's on the roadmap. Detailed artifacts are available under NDA for your security review.

GDPR & Data Processing Agreement (DPA)
EU Data Protection; SCCs Where Relevant
On request
EU Data Residency
Processed And Stored On EU-Based Infrastructure
Available
Sub-Processor Register
Current List Of Infrastructure Sub-Processors
On request
ISO 27001
ISMS In Build — Statement Of Applicability & Roadmap Under NDA
In progress
SOC 2
On The Roadmap After ISO 27001
Planned
Penetration Testing
Third-Party Testing Planned; Summary Shareable When Available
Planned

Painless Vendor Security Review

Ask for our security package under NDA — DPA, sub-processor list, ISMS Statement of Applicability, and a completed security questionnaire.

Request Security Package Company Details