Your data belongs to you
We know your colony data is sensitive research information. This page says how we protect it, what we use it for and which services handle it.
Encryption
All data is encrypted with AES-256 at rest in our PostgreSQL database. All network traffic is encrypted with TLS in transit. Sign-in sessions use secure, HTTP-only cookies that scripts on the page cannot read.
Infrastructure
ConductColony runs on Vercel (application hosting) and Neon PostgreSQL (database). Both providers maintain SOC 2 Type II compliance. Both run in the United States (US East), with redundancy built into each provider's platform.
Backups
Continuous backups with point-in-time restore: Neon PostgreSQL lets us restore the database to any moment up to 7 days back. We also save a restore point before every database upgrade. The database's storage is kept in more than one availability zone.
Access control
Role-based permissions (admin, manager, member and read-only viewer; core facilities add facility admin, staff, vet and PI) control who can view, create, edit and delete records in each organization. An activity log records changes to your records with who made them and when. You sign in with a ConductScience account, through ConductScience's sign-in service at auth.conductscience.com: with Google, Microsoft or ORCID, or with an email address and a password that the sign-in service keeps. Institutions on the Institution and Enterprise / CRO plans can connect their campus sign-in (SAML single sign-on). ConductColony keeps no passwords of its own.
Data export
CSV export at any time for your animal records, and for billing statements and reports in core facilities. No vendor lock-in: if you ever decide to leave ConductColony, we export all of your organization's records for you in a standard, portable format.
Data deletion
Request account deletion and all your data is permanently removed within 30 days, including from our backups. This includes all animals, cages, breeding records, genotypes, activity logs, and user accounts associated with your organization.
Multi-tenancy isolation
Strict organization-level data isolation. Every record belongs to one organization, and every request is checked against the signed-in user's organization. One organization cannot see another organization's data, even though they share a database.
What we don't do
Clear commitments about how we handle your data.
We don't sell your data
Your colony records, breeding data, and research information are yours. We use them to provide and improve ConductScience's products, including training its AI models. We do not sell your records or share them with advertisers.
We don't share your records with advertisers
Your colony records never go to advertisers or data brokers. Each service below handles data for us only to do its job.
Services that handle data for us
- Vercel: hosts the application (US East).
- Neon: hosts the database (US East).
- Resend: sends sign-in and notification emails.
- Stripe: processes payments for paid plans.
- Cloudflare Turnstile: screens the sign-up and contact forms for spam.
- Google Analytics: counts visits to our pages. It receives page addresses and titles, not your records' contents.
- Anthropic: runs the AI features, only on plans that include them (the Free plan includes one AI-assisted import to try) and only while AI is turned on. What each feature sends is listed below.
- ConductScience's own sign-in service: signs you in at auth.conductscience.com and holds your ConductScience account: your name, email address and sign-in details. We run it on Microsoft Azure in the United States (East US 2). If you sign in there with Google, Microsoft or ORCID, that provider confirms who you are.
- ConductScience's own customer records system: receives each user's email, sign-up date, last activity and plan, so we can support you.
- ConductScience's own breeding analysis service: runs the genomic breeding add-on's analyses, such as relationships, trait mapping and breeding values, for labs with the add-on. It receives only what an analysis needs: animals' record IDs, marker results, recorded parents and trait values, never names or ear tags, and keeps none of your records after it answers. We run it on Google Cloud in the United States (Northern Virginia).
What the AI features send to Anthropic
- AI-assisted import: your file's column headings and a few sample rows, to suggest how the columns map.
- Linnaeus, the assistant: your question and the conversation so far, today's date, the page or record you have open, and what its lookups read from your lab's records to answer you. A lookup reads only records you may see, such as animals, cages, breeding, protocols, alerts and activity. Those records can name people in your lab.
- The cross planner's typed request: the words you type, today's date, and your colony's loci: each one's name, kind, chromosome and alleles.
Anthropic's Commercial Terms of Service say that Anthropic may not train models on what these features send.
Security questions?
If you have specific security or compliance questions, or need documentation for your institution's vendor review process, contact us at support@conductscience.com.
Try ConductColony — Your Data Is Safe
Free tier available. No credit card required. Export your animal records at any time.