Security Information

Client-Side Encryption (Before Upload)

• Algorithm: AES-256 (Advanced Encryption Standard, 256-bit key)
• Encryption Location: Your browser (DNA file never leaves your device unencrypted)
• Key Management: Unique encryption key per user, stored securely in database
• Result: Even if intercepted during upload, DNA data is unreadable without your key

Data in Transit (HTTPS/TLS 1.3)

• Protocol: TLS 1.3 (Transport Layer Security, latest version)
• Certificate: SSL/TLS certificate from trusted Certificate Authority
• Cipher Suites: Strong encryption only (AES-GCM, ChaCha20-Poly1305)
• Result: All data transmitted between your browser and our servers is encrypted

Data at Rest (Database Encryption)

• Database: Supabase (PostgreSQL) with AES-256 encryption at rest
• Backup Encryption: All database backups encrypted with AES-256
• Key Rotation: Encryption keys rotated automatically by Supabase
• Result: Stored data is encrypted on disk, protected against physical theft

Row-Level Security (RLS)

Supabase Row-Level Security (RLS) policies ensure users can ONLY access their own genetic data:

• User Isolation: Database queries automatically filtered by user ID
• No Cross-User Access: User A cannot query User B's genetic data (enforced at database level)
• Admin Restrictions: Even admins cannot access raw genetic data without explicit consent
• SQL Injection Protection: RLS prevents unauthorized data access via SQL injection

JWT Authentication

• Token Type: JSON Web Tokens (JWT) issued by Supabase Auth
• Session Duration: 30 minutes (auto-refresh with user activity)
• Token Signing: Tokens signed with HS256 algorithm (256-bit secret key)
• Verification: Every API request validates JWT signature and expiration

Multi-Factor Authentication (MFA)

Status: Supported via Supabase Auth (TOTP - Time-based One-Time Password)

Recommendation: Enable MFA in your account settings for enhanced security

How to Report a Vulnerability

• Email: security@exomedna.com
• Subject Line: "[SECURITY] Brief description of vulnerability"
• Include:
  • Description of the vulnerability and potential impact
  • Steps to reproduce (proof-of-concept)
  • Affected URLs, endpoints, or components
  • Your contact information (for follow-up questions)
• Response Time: We will acknowledge your report within 48 hours
• Resolution Time: Critical vulnerabilities patched within 7 days

What NOT to Do

• Do NOT publicly disclose the vulnerability before we've had time to patch it
• Do NOT attempt to access or modify other users' genetic data
• Do NOT perform denial-of-service (DoS) attacks or load testing without permission
• Do NOT exploit vulnerabilities for personal gain

Bug Bounty Program

Status: Under consideration (not currently offered)

For now, we appreciate responsible disclosure and will publicly acknowledge security researchers who report valid vulnerabilities (with permission).

GDPR (General Data Protection Regulation)

• Article 9: Special category data (genetic data) protection with explicit consent
• Article 13: Privacy Policy transparency (all 11 requirements met)
• Article 15-22: User rights (access, deletion, portability, rectification)
• Article 30: Audit logging and record-keeping (7-year retention)
• Article 32: Security measures (encryption, access control, pseudonymization)

CCPA (California Consumer Privacy Act)

• Right to Know: Users can request all data we collect about them
• Right to Delete: Users can request deletion of all genetic data
• Right to Opt-Out: We do not sell personal data (no opt-out needed)
• Right to Non-Discrimination: No penalty for exercising privacy rights

GINA (Genetic Information Nondiscrimination Act)

• No Insurance Sharing: We never share genetic data with insurance companies
• No Employment Sharing: We never share genetic data with employers
• User Control: You control who sees your genetic results (nobody by default)

Educational Use Only (NOT Medical Device)

Important Disclaimer: ExomeDNA is NOT a medical device and is NOT FDA-cleared. Our genetic analysis is for educational and research purposes only.

• Not Medical Advice: Results should not be used for medical diagnosis or treatment
• Consult Professionals: Discuss any health concerns with a licensed healthcare provider
• No FDA Approval: Our analysis methods are not FDA-approved or validated for clinical use