Security and IP
Your clients' structures are your clients' IP. We build like it.
When your client asks where their molecule went, you need an exact answer and a contract to point at. That is the requirement we build against.
The core commitments
Kept apart by customer
Each customer's structures, routes and job data are separated from every other customer's. Every query is scoped to your organization, and Postgres row-level security enforces the same separation in the database.
Never training data
We do not train models on your data. Model calls go to Anthropic and Google Vertex AI under commercial terms that bar them from training on it. Anthropic deletes API inputs and outputs within 30 days, and content its safety systems flag can be kept up to 2 years. Google keeps a prompt only if its abuse systems flag it, for up to 90 days. We do not have zero-retention agreements with these providers.
Ownership
Inputs, outputs, routes and reports are yours. We take no license beyond what we need to run your jobs.
Ryniant access is logged
Authorized Ryniant administrators can open a workspace to operate, support and secure the service. Every such read is recorded in an audit log and raises an internal alert.
Deletion
Every job logs what was retrieved and cited. When your contract ends you have 30 days to export your data. We then delete it within the following 30 days and send you a deletion certificate.
Deployment
SynthPlanner runs as a managed service on Google Cloud in the United States (region us-central1). Traffic between your browser and SynthPlanner is encrypted with TLS 1.2 or higher. Stored data is encrypted at rest with AES-256.
Your notebook, specifically
Notebook (ELN) search is not part of the production service yet. Before it launches we will update this page and our subprocessor list.
How a run is traceable
Every agent run records the context it saw, the tools it called, the sources it retrieved, and the citations behind each claim. A chemist or an auditor can reconstruct exactly why the system did what it did, and every decision is logged.
Certifications
We are building toward SOC 2 Type II and will state the status here when the audit is complete. Model calls go to the providers on our subprocessor list, under terms that bar training on your data. We do not claim HIPAA, GxP or other regimes that do not apply to this product today.
Questions
Security questions: security@ryniant.com. Read our Subprocessors list.