Your experiments are yours alone
Experimental data is proprietary before it is scientific. The platform is built so that your datasets, models and results are isolated to your account, never pooled, and never used to train anything shared.
Authentication
Passwords are stored as salted hashes — the server never keeps plaintext. You can also sign in with Google via Firebase, in which case the platform only ever receives the identity you choose to disclose.
Every session is tracked server-side. Settings → Security shows every active session with device, IP and last activity, and lets you revoke any of them with one click — including the current device.
Data isolation
Uploaded and generated files are stored on the server filesystem scoped to your account, and every file path is validated against your own storage directory before it is served — another user's request cannot reach your files.
Account and job metadata live in the application database, and jobs run with per-account isolation enforced at the request boundary.
Your data is never used to train shared models
Every model the platform trains for you — predictor, synthesis generator, optimizer surrogate — is trained on your data alone, for your account alone. Nothing is merged into a global or shared model.
This is a policy statement backed by the architecture: model artifacts are per-job and per-account, not pooled.
Abuse protection
Account creation and public forms are protected by Cloudflare Turnstile bot detection.
Per-tier rate limits on jobs per hour, concurrent jobs, upload size and storage keep the platform responsive for everyone — and repeated deliberate abuse can be throttled or suspended, as described in the Terms of use.
New accounts require administrator approval before they can run jobs.
API keys
Programmatic access uses per-user API keys issued from Settings → API Keys. Keys can be created, rotated and revoked at any time without touching your session.
Each request is rate-limited against your tier the same way the web app is.
Audit & transparency
Login sessions record IP and user-agent so you can audit your own account history.
Run configuration and results are stored per job, making every model run reproducible from the platform's own records.
What happens to your data — retention, deletion, third-party processors — is spelled out in the Privacy policy, not buried in fine print.
What you can do to stay secure
Small habits that matter more than any feature.
- Use a strong, unique password — the platform enforces a minimum length and shows a live strength meter at registration.
- Sign in with Google if your institution uses it — you get their account security for free.
- Review the active sessions list occasionally and revoke anything you do not recognize.
- Use dedicated API keys per integration, and rotate them when a script or notebook changes hands.
- Never paste proprietary data into the AI assistant that you would not want to leave the platform — assistant messages are processed by a third-party LLM API (see Privacy).
- If you leave an institution, delete or deactivate your account from Settings → Data & account so your data leaves with you.
Questions about how your data is handled?
We publish the full details in the privacy policy, and the security team answers directly — no ticket roulette.