Security

How the apps handle your data

Scientific computation runs in your browser. Individual apps and the current Bench preview are free without an account. Bench data stays in this browser; future account mode uses Supabase for sign-in and private backups and Stripe for billing. This page explains those data flows and the public services each app contacts.

Architecture

Static files. Pages, scripts, data files and images are built ahead of time and served by the site's host.
Requests to the public services an app lists below go from your browser, as a visit to their websites would. Some requests go through the site's server instead: literature searches; drafted extractions, search plans and Study summaries; compound and protein name suggestions and lookups; and compound descriptions. The server sends them to the services listed under “Services the site server contacts on your behalf”.
Accounts are optional for individual apps. Bench sign-in uses essential session cookies; subscription checkout and management take place with Stripe.
No analytics and no error reporting in the apps. Nothing in an app workspace reports to an analytics or monitoring service.
No fonts or scripts from other origins. Fonts, the Mol* viewer and the RDKit chemistry engine are served from this site.

What leaves your browser

Anything in the address bar before the # (a search, a SMILES, an accession or a step) is sent to this site's host when a page loads or a link is opened; anything after the # is not sent.
What you look up (a search, an accession, a condition, a name) is sent to the public service that answers it, which sees it with your IP address under its own terms.
Work and preferences are saved in this browser. Choosing Back up this Study sends its recovery bundle to the site server and private Supabase storage. Signing in alone does not upload your research.
A link you copy carries what is in the address bar, and anyone you send it to can read it. Chat and mail tools may also fetch a link to show a preview.

Hosts each app contacts

The lists below come from each app's registry entry. The browser holds every app page to its list through the Content-Security-Policy header, which is generated from the same entry.

Drybench Protein.

Scientific requests go directly to public services; computation is local, with no analytics and no font or script from another origin. Optional Bench accounts use session cookies and the site server for sign-in, billing and chosen Study backups. The identifiers you look up go from your browser to the six public hosts listed here, and the site's host keeps standard web-server logs.

rest.uniprot.org
Operator
UniProt Consortium (EMBL-EBI, SIB and PIR)
What for
Search, and the protein's entry: names, function, location, sequence and features.
What it receives
your search text and UniProt accessions
When
on lookup
www.ebi.ac.uk
Operator
EMBL-EBI
What for
PDBe: the PDB entries mapped to the protein, the residues each one resolves, residue numbering and structure files. The EBI Proteins API: the full variant list, when you ask for it.
What it receives
UniProt accessions and PDB ids
When
on lookup
data.rcsb.org
Operator
RCSB PDB (United States)
What for
Atom counts, so that very large entries load one chain first.
What it receives
PDB ids
When
on lookup
models.rcsb.org
Operator
RCSB PDB (United States)
What for
A second source for structure files when PDBe does not answer.
What it receives
PDB ids
When
on lookup
alphafold.ebi.ac.uk
Operator
EMBL-EBI (AlphaFold DB)
What for
The predicted model, its per-residue confidence, and AlphaMissense scores when you ask for them.
What it receives
UniProt accessions
When
on lookup
api.platform.opentargets.org
Operator
Open Targets
What for
Drugs and clinical candidates for the target, with mechanisms, stages, indications and warnings.
What it receives
the target's Ensembl gene id, or its UniProt accession when the entry gives no Ensembl id
When
on lookup

Full security overview for this app (Drybench Protein)

Drybench Molecule.

RDKit.js runs in a Web Worker in your browser. Compound-name suggestions use the bundled catalogues. Name lookups contact PubChem through this site. Selected public identifiers retrieve structures and attributed context from PubChem or ChEMBL; the separate pasted or drawn structure is never sent for these lookups.

pubchem.ncbi.nlm.nih.gov
Operator
NCBI, U.S. National Library of Medicine
What for
Suggests compound names while you type, looks up structures beyond the local catalog and retrieves descriptions for selected public compound identifiers.
What it receives
compound names submitted to search and selected public compound identifiers
When
on lookup
www.ebi.ac.uk
Operator
EMBL-EBI
What for
Retrieves exact catalogued structures and recorded mechanisms through this site for selected public ChEMBL identifiers.
What it receives
the ChEMBL identifier of the selected compound
When
on lookup

Full security overview for this app (Drybench Molecule)

Drybench Pipeline.

Searches go from your browser straight to clinicaltrials.gov and api.fda.gov, and the site's host serves only the app's files. Counting and classifying run in your browser.

clinicaltrials.gov
Operator
U.S. National Library of Medicine
What for
Trial records for the condition and filters you search, and the registry's processing date; for a product opened in FDA precedent, a check that the NCT numbers its label names are registered; on a trial's object page, that trial's record.
What it receives
the condition and filters you search, NCT numbers taken from a label, and the NCT number of a trial whose page you open
When
on lookup
- FDA precedent: at most 1 request for each product you open, to check the NCT numbers its label names.
api.fda.gov
Operator
U.S. Food and Drug Administration
What for
US drug labels that name the condition, with the Drugs@FDA and NDC records of their applications; for FDA precedent, how many complete response letters each application has (no search is sent), the file names of any published after the snapshot, and the label of a product you open, for the trials its Clinical Studies section names; on a US product's object page, the Drugs@FDA and NDC records of its applications.
What it receives
the condition you search, application and product codes taken from openFDA's own answers, and the application numbers of a US product whose page you open; the complete response letter count is requested with no search
When
on lookup
- Per condition: at most 12 requests for the US approvals (measured weekly on the seven examples).
- FDA precedent: 1 request per visit to count complete response letters, with no search sent, plus 1 for each application with a letter published after the snapshot; 1 label request for each product you open.

Full security overview for this app (Drybench Pipeline)

Drybench Cell.

The tour runs entirely in your browser and contacts no host but its own: no scientific service, no analytics, and no fonts or scripts from anywhere else.

The app contacts no host but its own.

Full security overview for this app (Drybench Cell)

Drybench Patent.

Nothing is fetched from the FDA in your browser: the app reads one static store built from the FDA's files and served by this site, and the search runs in your browser.

The app contacts no host but its own.

Full security overview for this app (Drybench Patent)

Drybench Calc.

Every calculation runs in your browser. Optional compound searches send names through this site to PubChem; the built-in reagent table works locally. No account is needed for scientific use; optional Bench sign-in uses session cookies.

pubchem.ncbi.nlm.nih.gov
Operator
NCBI, U.S. National Library of Medicine
What for
Retrieves the selected compound's complete formula and structure through this site.
What it receives
the compound name searched or selected
When
on lookup

Full security overview for this app (Drybench Calc)

Drybench Sequence.

Every scientific operation runs in your browser. Optional UniProt search sends your submitted query and selected accession to rest.uniprot.org; the separate sequence input stays local. Scientific use needs no account; optional Bench sign-in uses session cookies, and the two links that leave the site (ProtParam and BLAST) say that they upload what you send.

rest.uniprot.org
Operator
UniProt Consortium (EMBL-EBI, SIB and PIR)
What for
On Search UniProt, find protein records; on result selection, retrieve the full canonical sequence and source metadata.
What it receives
the search text submitted to UniProt and the selected accession; never the separate pasted sequence
When
on lookup

Full security overview for this app (Drybench Sequence)

Drybench Assay.

Every fit runs in your browser from the suite's shared modules, in a Web Worker for a batch; the app contacts no host besides its own, needs no account for scientific use; optional Bench sign-in uses session cookies, your plate data are kept in this browser and in the session file you export, and a shared link carries the view and fit settings only.

The app contacts no host but its own.

Full security overview for this app (Drybench Assay)

Drybench Plasmid.

The map is computed in your browser, in a Web Worker; the app's data files load from this site, the only other host it can contact is NCBI, and only when you press Fetch from NCBI for an accession. Your plasmids and edits are kept in this browser, and a shared link carries the sequence of a small plasmid, never your feature edits.

eutils.ncbi.nlm.nih.gov
Operator
NCBI, US National Library of Medicine
What for
Fetching a public nucleotide record by accession, only when you press Fetch from NCBI.
What it receives
The accession you typed or a link armed, and your IP address
When
only when you confirm
- one accession: 1 request

Full security overview for this app (Drybench Plasmid)

Drybench Bioreactor.

Every run is computed in your browser, in a Web Worker; the app contacts no host besides its own, needs no account for scientific use; optional Bench sign-in uses session cookies, a run you keep stays in this browser, and a shared link carries the preset and the parameters you changed, never results.

The app contacts no host but its own.

Full security overview for this app (Drybench Bioreactor)

Services the site server contacts on your behalf

These requests are sent by the site's server, not your browser. A host only the server contacts is in no app's Content-Security-Policy. The list comes from the registry's services section, which the server's own checks also read.

www.ebi.ac.uk
Operator
Europe PMC, EMBL-EBI (UK)
What for
Searches the biomedical literature and returns papers' records and, where open access, their full text.
What it receives
The search text, filters and paper identifiers sent from the literature workspace, in a request from the site server.
When
on lookup
Sent by
/api/literature, /api/literature/search, /api/literature/fulltext, /api/literature/extract, /api/literature/discover
api.openalex.org
Operator
OpenAlex, OurResearch (US)
What for
Searches scholarly works by keyword or meaning, resolves paper identifiers and finds related works.
What it receives
The search text and paper identifiers sent from the literature workspace, in a request from the site server with the site's API key.
When
on lookup
Sent by
/api/literature, /api/literature/search, /api/literature/discover, /api/literature/fulltext, /api/literature/extract
The server sends the site's own API key (OPENALEX_API_KEY).
api.anthropic.com
Operator
Anthropic (US; Anthropic Ireland in the EEA, Switzerland and the UK)
What for
Drafts the literature extractions, search plans and Study summaries a person asks for.
What it receives
The paper text to extract from, the question to plan a search for, or the Study packet to summarise, sent by the site server with the site's API key when the person asks for one of these.
When
only when you confirm
Sent by
/api/literature/extract, /api/literature/plan, /api/study/summary
The server sends the site's own API key (ANTHROPIC_API_KEY).
pubchem.ncbi.nlm.nih.gov
Operator
PubChem, US National Center for Biotechnology Information
What for
Completes compound names, looks up a named compound's formula and identity, and reads a compound's description.
What it receives
The compound name or PubChem identifier typed into a search, in a request from the site server.
When
on lookup
Sent by
/api/search/compounds, /api/search/compound, /api/search/molecule-description
www.ebi.ac.uk
Operator
ChEMBL, EMBL-EBI (UK)
What for
Reads a ChEMBL compound's record and its recorded mechanisms.
What it receives
The ChEMBL identifier of the compound looked up, in a request from the site server.
When
on lookup
Sent by
/api/search/molecule, /api/search/molecule-description
rest.uniprot.org
Operator
UniProt Consortium (EMBL-EBI, SIB, PIR)
What for
Suggests proteins of every organism beyond the bundled human index.
What it receives
The protein name, gene or accession typed into a search, in a request from the site server.
When
on lookup
Sent by
/api/search/proteins

Data shipped with the suite

Suggestions, name recognition and cell line records use these datasets, served from this site. Each keeps its provider's licence, named below.

ChEMBL clinical-stage compound names
ChEMBL 37, EMBL-EBI: preferred names, synonyms, highest recorded clinical phase and molecule type.
Licence
CC BY-SA 3.0
Release
ChEMBL_37
Retrieved
7 October 2026
UniProt reviewed human proteins
UniProt Consortium, UniProtKB/Swiss-Prot reviewed human entries: accession, entry name, names, gene and length.
Licence
CC BY 4.0
Release
not recorded in the download
Retrieved
7 October 2026
Human Disease Ontology
Disease Ontology: terms, EXACT synonyms and direct parent labels.
Licence
CC0 1.0
Release
releases/2026-09-30/doid.obo
Retrieved
7 October 2026
NIH Global Substance Registration System
NCATS / FDA Global Substance Registration System, UNII NOP2Y096GV, alternate chemical definition 210e2d2c-6b8e-4b0d-b432-20057541f324, version 1, retrieved 8 October 2026.
Licence
Data (cited)
Release
UNII NOP2Y096GV, alternate chemical definition version 1
Retrieved
8 October 2026
Cellosaurus
Cellosaurus, SIB Swiss Institute of Bioinformatics: cell line names, synonyms, accessions, species, diseases, sex, age, "Problematic cell line" comments and STR profiles. Bairoch A. The Cellosaurus, a cell line knowledge resource. J. Biomol. Tech. 29:25-38 (2018).
Licence
CC BY 4.0
Release
56.0
Retrieved
17 October 2026