Security & Privacy

LatticeZero is designed for pharmaceutical IP protection. This page documents exactly what happens to your data at each stage.

Data Flow Overview

Shield Mode (WebGPU Scoring)

When you use IsoScore or the Demo Gallery, all scoring runs entirely in your browser:

1. File parsing: Your PDB and SDF files are read by the browser's File API - they are never uploaded to our server.
2. GPU computation: Scoring runs on your local GPU (or CPU via SwiftShader fallback) using WebGPU compute shaders.
3. Results display: Scores are computed and displayed locally. No compound structures, scores, or intermediate data are transmitted over the network.
4. Session end: When you close the tab, all data is gone. Nothing persists on disk or in the cloud.

The "Shield" and "Zero-Trace" badges on IsoScore indicate this fully client-side execution path. Our servers never see your compound structures during WebGPU scoring.

What crosses the network during IsoScore? Only the initial page load (HTML, JavaScript, WGSL shader code) and authentication tokens. Your receptor coordinates, ligand structures, and scoring results stay entirely in your browser's memory.

Server-Side Operations

Some operations require server computation:

IsoPose (Docking)

• Upload: Receptor PDB and ligand SDF files are uploaded to the server via HTTPS (TLS 1.2+).
• Processing: Files are stored in a per-user, per-job directory on the server during docking.
• Results: Docked poses and scores are returned to your browser.
• Cleanup: Job files are subject to the retention policy (see below).

Target Prep

• Upload: Receptor PDB is uploaded for grid compilation.
• Processing: Grid compilation runs on the server.
• Output: Compiled grid data is stored in your project.

Data Retention

When a job is deleted (automatically or manually), the server removes:

• Input files (receptor, ligands)
• Output files (docked poses, scores)
• Job metadata from the database

Data Isolation

• Per-user storage: Each user's files are stored in isolated directories. Users cannot access other users' data.
• Authentication required: All API endpoints require authentication. Job ownership is verified on every access.
• No shared state: WebGPU scoring sessions are completely independent - there is no server-side state to leak between users.

What We Don't Do

• We do not mine or analyze your compound structures. Server-side files exist only to run the computation you requested.
• We do not train models on your data. Scoring profiles are developed using public benchmark datasets (DEKOIS2, DUD-E).
• We do not share data with third parties. Your files are never transmitted to external services.

Network Security

• HTTPS everywhere: All traffic uses TLS encryption in transit.
• No third-party analytics on compound data: WebGPU scoring is offline by design.
• CSRF protection: All form submissions include CSRF tokens.
• Input validation: Uploaded files are validated for format correctness (PDB/SDF/MOL2) before processing.

Reproducibility & Integrity

Every scoring run includes provenance metadata:

• SHA256 signatures for input files (receptor, ligands, profile) via the Asset Signature system
• Code version tracking (git SHA) for exact reproducibility
• Replication kits available for all demo benchmarks - download the full input bundle and verify independently

Compliance Notes

• Pharma IP Protection: IsoScore's Shield Mode is specifically designed for scoring proprietary compound libraries without exposing structures to any server. This addresses the primary concern of pharmaceutical companies: keeping compound structures as trade secrets.
• GDPR: User accounts can be deleted on request. Job data deletion is available via API and UI. Zero-Trace mode provides minimal-retention operation.
• SOC 2 / ISO 27001: Not currently certified. LatticeZero is an early-stage platform. We document our security architecture transparently rather than making unsubstantiated compliance claims.

Summary

For questions about data handling, contact security@latticezero.com.