Security & Data Handling
How PlasmidStudio stores, processes, and protects your data.
Architecture Overview
PlasmidStudio is a browser-based application. Your constructs are stored in a cloud database, and AI design requests are processed through a proxy server — never sent directly from your browser to AI providers.
Data Storage
- —Database: Your construct data — names, features, sequences, and metadata — is stored in a managed cloud database.
- —Encryption at rest: AES-256 at the database level. API keys (admin and user-provided) are encrypted with AES-256-GCM before storage.
- —Encryption in transit: All connections use TLS 1.3. No data is transmitted unencrypted.
AI Processing
- —Proxy architecture: AI requests are routed through a server-side proxy. Your browser never communicates directly with AI providers.
- —Data retention by AI providers: Per their API terms, our AI providers do not use API inputs/outputs to train models. Providers may briefly retain requests for abuse monitoring and safety purposes.
- —API key security: All API keys are encrypted with AES-256-GCM before storage. User-provided BYO keys are resolved server-side and never exposed in the browser.
Authentication
- —Magic link authentication: PlasmidStudio uses email magic links. No passwords are stored or transmitted.
- —Session management: JWT-based session tokens verified on every API call.
What we don't have yet
PlasmidStudio is an early-stage product. We believe in being upfront about what we haven't built yet:
- ✗SOC 2 certification — Not yet pursued. On our roadmap as user base grows.
- ✗21 CFR Part 11 compliance — Not available. PlasmidStudio is a design tool, not a validated GxP system.
- ✗SSO / SCIM — Not yet available. Currently email-based magic link only.
- ✗Audit trails — No detailed access or change logs beyond construct version history within sessions.
- ✗On-premises deployment — Cloud-only. No self-hosted option.
If any of these are blockers for your organization, let us know — it helps us prioritize.
Data Deletion
- —Individual constructs: Delete any construct at any time from the sidebar. Deletion is immediate and permanent.
- —Full account deletion: Email security@plasmidstudio.ai to request complete deletion of your account and all associated data.
Security questions or concerns? Contact us at security@plasmidstudio.ai
Last updated: March 2026