Security: what this actually does
Last updated 26 September 2026
There is no SOC 2 report. This page is the alternative: a plain description of what the code does, specific enough that you can hold us to it. The privacy notice says what is collected and for how long.
No SOC 2 yet
An audit is a statement that someone checked. It is worth having and we have not had one, so instead of implying otherwise, here is what the system does, in enough detail that you can ask us about any line of it. If your procurement process needs the report itself, say so early and we will tell you honestly where we are.
Who the data reaches
| Who | What they get | Why |
|---|---|---|
| Anthropic | The procedure text you paste | Reading the chemicals out of it. Their commercial terms forbid training on it, and they delete API inputs within 30 days. |
| Railway | The application and its database | Hosting. |
| MolPort, ChemSpace, Mcule | A chemical's name, structure and amount | Finding real offers. Never your name, email or pasted text. |
| Firecrawl | Supplier page addresses | Fetching a supplier's own public page when no marketplace lists the chemical. |
That is the whole list. Nothing here loads a third-party script, font, analytics tag or advertising pixel, which is why this page can say so.
Your session
A trial is one random token in one cookie. It is HttpOnly, so a script on the page cannot read it and neither can anything injected into one; SameSite=Lax, so another site cannot make your browser send it with a form post; and Secure everywhere but a local development machine, so it never travels unencrypted. Only a one-way hash of the token is stored, so the database does not hold anything that would let someone sign in as you.
Requests from other sites
Every request that changes something is checked against the site it came from, and refused when that is not this one. A request that names no origin at all has to carry a header that only this app's own page can set. Browsers are only allowed to make credentialed cross-origin requests from origins listed by name, and on a deployed instance that list is empty.
What the pages are allowed to do
Every response carries a content security policy that permits scripts, styles, images, fonts and network calls from this site only, forbids this app being put in a frame, and forbids a form on these pages submitting anywhere else. API answers are marked not to be stored by any cache. Over HTTPS the browser is told to use HTTPS for a year.
What is kept as a hash
Your email address is kept after your trial is deleted as a keyed hash: we can check whether an address is already on the list, but neither we nor anyone holding a copy of the database can read the list back as addresses. The key is not in the database. This is worth being precise about, because a plain SHA-256 of an email address would not be: the set of possible inputs is a list of people you can guess, and guessing a couple of dozen likely addresses against such a table is enough to read most of it. The network address a trial started from is kept the same way, hashed with the date, for that day only so one person cannot take every place, and deleted afterwards. The email entry is kept for 12 months.
How long anything lives
A trial and everything in it are deleted 30 days after it starts. The deletion is not a scheduled job somebody has to remember to deploy: the application purges expired trials as it serves ordinary requests, and again whenever it restarts. Deleting a trial deletes its papers, its compounds and their supplier offers in the same statement, so a deletion cannot stop halfway and leave your pasted procedure behind. You can trigger it yourself at any time with Delete my trial now, including after your trial has expired.
Separation between trials
Every row belongs to exactly one trial, and every database call takes the caller's scope as a required argument, so a route that forgot to pass one would fail on its first request rather than quietly serving somebody else's data. A row you may not see is reported exactly like a row that does not exist, which is what stops anyone learning what else is in there by trying identifiers.
Money and orders
No payment details are collected, held or processed: there is nothing to pay for yet. The tool never places an order. It produces a list a chemist approves, and the buying happens wherever your lab already buys. Nothing here can spend your money, and a per-day ceiling on the paid lookups bounds what it can spend of ours.
What we would tell you if you asked
- The sign-in for the owner's own view is one shared password, not a user directory. It is the owner's account, not yours.
- Supplier offers are cached for up to seven days, keyed by the chemical, not by who asked.
- Prices and lead times come from marketplaces and, where none lists a chemical, from reading suppliers' pages. A chemist checks the list before anything is bought, which is the design, not a caveat.
Reporting something
If you find a way to reach data that is not yours, write to siyun_cao@outlook.com and we will answer. There is no bounty and no legal paperwork to sign first.