ExomeDNA security
How we protect genetic data.
Last updated: June 2026
ExomeDNA is built around a simple rule: raw genetic data should have the shortest useful life possible. We use your DNA file to generate your trait report, discard the raw file after scoring, and protect the results that remain with authentication, consent gates, database access controls, and secure infrastructure providers.
This page summarizes ExomeDNA security practices for raw DNA uploads, genetic data privacy, AI boundaries, account access, and responsible disclosure.
The Toxic Waste Protocol
We handle raw DNA as sensitive material to be used briefly, not kept indefinitely. The raw file is processed to create derived trait scores, then discarded after scoring. Your ongoing ExomeDNA account contains your report and trait-level results — not a retained raw DNA file.
What ExomeDNA keeps, and what we discard
| Data category | How it is handled |
|---|---|
| Raw DNA upload | Processed transiently to generate your report, then discarded after scoring. |
| Parsed genotype values | Used during scoring and cleanup; not retained as an account data product. |
| Derived trait results | Stored in your account so you can view your report and revisit your results. |
| Account data | Used for authentication, consent, privacy controls, and access to your report. |
| Payment data | Processed by Stripe. ExomeDNA does not store full payment card numbers. |
This minimization approach reduces the amount of raw genetic material ExomeDNA has to protect over time. The durable account record is the derived report: scores, categories, interpretations, and citations.
Account and database protection
ExomeDNA uses Supabase Auth and signed JSON Web Tokens for sensitive account routes. Database access is scoped with Row-Level Security so user-facing data access is limited by account ownership.
- Row-Level Security: user-facing database tables are protected with RLS policies.
- Service-role separation: sensitive backend operations run through backend-controlled service access, not browser-controlled permissions.
- MFA support: time-based one-time password MFA is supported and enforced for enrolled users on protected genetic-data reads.
- Audit trail: sensitive genetic-data operations are designed to leave an audit record.
The AI boundary
Gene, the ExomeDNA AI assistant, is separated from raw genetic data. The AI assistant is not given your raw DNA file or genotype table. If you choose to use AI features, ExomeDNA sends limited trait-level context needed to answer your question, and only after separate consent.
- AI use is optional and requires separate consent.
- Raw DNA uploads and genotype tables stay outside the AI path.
- AI context is built from derived trait-level results, report categories, and user-authorized conversation context.
- Anthropic processes AI requests under its commercial terms; ExomeDNA does not use AI conversations to sell genetic data.
Encryption and infrastructure
ExomeDNA traffic is served over HTTPS/TLS. We also deploy browser and API security headers, including HSTS, frame protection, content-type protection, referrer policy, and permissions policy.
ExomeDNA uses established infrastructure providers for authentication, database storage, hosting, payments, and optional AI features. Our database provider, Supabase, states that customer data is encrypted at rest with AES-256.
| Provider | Role |
|---|---|
| Supabase | Authentication, database, Row-Level Security, and account data storage. |
| Vercel | Frontend hosting for the ExomeDNA web application. |
| Render | Backend hosting for the ExomeDNA API and scoring pipeline. |
| Anthropic | Optional AI assistant processing, only after separate user consent. |
| Stripe | Payment processing for purchases and subscriptions. |
| PostHog | Product analytics for service improvement. |
Consent and user controls
ExomeDNA separates core service consent from optional AI consent. You can use ExomeDNA without authorizing AI features, and you can manage privacy controls from your account.
- Explicit consent is required before DNA processing.
- Separate consent is required before AI assistant use.
- You can export your account data and report data.
- You can request account and data deletion.
- You can revoke optional AI consent.
What ExomeDNA does not do with genetic data
- We do not sell your genetic data.
- We do not share your genetic data with employers.
- We do not share your genetic data with insurers.
- We do not use raw DNA uploads as an ongoing company asset after your report is generated.
Responsible disclosure
If you believe you have found a security issue in ExomeDNA, please contact us privately so we can investigate and respond responsibly.
Email: security@exomedna.com
Educational use only
ExomeDNA provides educational genetic information. It is not medical advice, has not been cleared or approved by the FDA, and should not be used for clinical decisions.