Trust & Data
Your data is your IP
Sequences, target proteins, and project context are the core intellectual property of any R&D team. Here is exactly what we do — and do not do — with them.
Commitments
What we promise
No training on your data
Your sequences, target proteins, and project data are never used to train or fine-tune any model — ours or anyone else's. Our training sets are built from public-literature-graded records only, and every record is screened before it enters the pipeline: anything carrying a sequence payload (30+ bp DNA, 40+ aa protein) is quarantined at the gate, and private sources and user identifiers are dropped.
NDA on request
We support mutual NDAs in pilot and enterprise engagements. Contact lei@bluex.net.cn to initiate.
Data residency
Processing runs on our own infrastructure in China (Aliyun). Retrieval is self-hosted (Qdrant). Reasoning is generated by DeepSeek language models via DeepSeek's API — your research question and the retrieved literature snippets are transmitted to DeepSeek for processing, and are not used by DeepSeek to train models (per DeepSeek's API terms); cross-border terms are disclosed in our Privacy Policy. A question that carries a sequence-shaped payload is refused before it is sent — our egress gate intercepts sequences (DNA runs of 30 or more, protein runs of 40 or more), and structure checks accept a UniProt accession only, so a sequence you paste never leaves.
Delete on request
Research sessions and delivery reports are stored in your own project — that is what lets you follow up on a delivery, compare versions, and trace its lineage. Sequences stay inside that project record and are never used for training. You can ask us to delete your project data at any time via lei@bluex.net.cn: deletion is carried out by hand on request, and we report back what was removed and what could not be addressed by name — an incomplete result is reported as incomplete, never rounded up.
Technical safeguards
Transport & site security
The following measures are enforced on all evolrix.bio responses (verified live as of 2026-07-17):
HSTS — Strict-Transport-Security: max-age=31536000; includeSubDomains
Content Security Policy — enforced (reporting enabled for anomaly detection)
X-Frame-Options — SAMEORIGIN (clickjacking prevention)
X-Content-Type-Options — nosniff (MIME-type sniffing prevention)
Referrer-Policy — strict-origin-when-cross-origin
Permissions-Policy — geolocation=(), microphone=(), camera=()
TLS — 1.2+ enforced for all connections
Automated adversarial testing
We attack our own review layer — on every change, on the record
On every change to the review layer, an automated probe runs a real research session on the public path containing a deliberately fabricated citation (PMID:99999999) and a fabricated 12 g/L titer claim. The session is healthy only when the review layer stamps the fabrication — WARN or FAIL. If a fabricated claim ever receives PASS, the build fails — that failure is the alert.
Why do this: a reviewer that never fails a test is a reviewer you cannot trust. The probe is a standing regression test — it verifies the audit behaves correctly against known-bad input, not just against honest output.
Current record: the two probes of 2026-07-27 were both caught — session verdict FAIL, fabricated claim stamped. The standing probe that entered CI on 2026-09-20 was healthy on its first run: all five fabricated citations and the fabricated 12 g/L titer were stamped unverified, never PASS. Every run prints its verdict and exit code into the build log.
Scope: this is an automated regression test for the review layer. It raises confidence in the mechanism; it is not a correctness guarantee for any individual dossier.
Related
Linked policies
Privacy Policy — detailed data handling for chat, feedback, and local storage.
Acceptable Use — what users may and may not do.
Safety & Responsibility — biosecurity screening and dual-use review.
Terms of Service — engagement terms.
Provenance, not persuasion. Your sequences stay yours.
Your sequences stay yours. Put them to work
No training on your data, delete on request — stated on the record.