Data Security & Zero-Retention

1. Overview

MolWard provides in silico pharmaceutical development and compliance tools. We recognise that the structures, sequences, and process parameters you enter are among your most sensitive intellectual property. The platform is architected around a single principle: compute in memory, retain nothing.

2. Zero-retention by design

For the analytical tools, the chemical structure, sequence, or dataset you submit is processed in volatile memory for the duration of a single request and is not written to a database or persistent store by the calculation engines. When the response is returned, the working data is released. We do not build a corpus of customer molecules, and we do not use your inputs to train models.

• No customer structure, sequence, or dataset is persisted by the calculation engines.
• Results are generated on demand and delivered to you; they are not archived on your behalf.
• Where a tool produces a report, the document is generated in memory and streamed to you for download.

3. Data in transit & at rest

All traffic between your browser and MolWard services is encrypted in transit using industry-standard TLS. Static content and application front ends are served over HTTPS. Because the platform is zero-retention by design, customer scientific inputs are not stored at rest by the calculation engines.

4. AI processing

Some tools offer an optional AI-assisted narrative or interpretation. When you invoke it:

• Only the already-computed result values needed for the draft are sent to the language model — never more than necessary.
• The model runs under a strict, low-temperature, role-locked configuration and is numerically and citation guard-railed: it may only use the numbers from your computed result and may only cite an allow-listed set of guidelines.
• Every AI output is explicitly labelled a draft for expert review and is never presented as a regulatory decision.
• We use the model provider under a configuration intended to exclude your data from provider model training.

5. Report integrity (21 CFR Part 11 philosophy)

Reports are stamped with a report identifier, a UTC generation timestamp, and a SHA-256 integrity hash computed over the canonical result. This makes a report tamper-evident: the hash can be recomputed later to confirm the document was not altered. This supports a 21 CFR Part 11 / ALCOA+ data-integrity workflow; it does not by itself constitute a validated Part 11 system, which remains the responsibility of the deploying organisation.

6. Access & authentication

Public tools are open for evaluation. Restricted tools are protected by an access credential. Access controls are enforced server-side; browser-level controls such as CORS are used for hygiene but are not relied upon as an access boundary.

7. Infrastructure & sub-processors

MolWard runs on established cloud infrastructure providers and uses a small number of sub-processors strictly to deliver the service (application hosting, static site delivery, and — only when you invoke it — an AI model provider). We do not sell data to, or share customer scientific inputs with, any third party for their own purposes. A current list of sub-processors is available on request.

8. What we never do

• We never sell your data.
• We never train our or third-party models on your submitted structures, sequences, or datasets.
• We never expose internal errors or stack traces to end users in production.
• We never present an AI draft as a validated regulatory conclusion.

9. Compliance posture

MolWard is currently offered as a Beta program. We design to the principles behind GDPR (data minimisation, purpose limitation) and 21 CFR Part 11 (integrity, traceability). MolWard is not yet independently certified to SOC 2 or ISO 27001; formal third-party attestation is a planned milestone, and we will publish it here when achieved. We will not claim a certification we do not hold.

10. Responsible disclosure

If you believe you have found a security vulnerability, please contact us at contact@molward.com with details. We ask that you give us a reasonable opportunity to remediate before any public disclosure.

11. Contact

Questions about security or data handling: contact@molward.com. See also our Privacy Policy Security & Zero-Retention Scientific Methodology Release Notes and Terms.