Data sources

This page lists every external data source and service the suite uses, ships data from or sends user input to, with the licence facts the repository records for each, how the data reaches the user and what leaves the browser. It is built from the app registry (content/apps.ts and content/apps/<slug>.ts), the server routes under src/app/api/, the pipeline snapshots and docs/board/open-questions.md; legal conclusions are not drawn here and are marked as held for the General Counsel.

How sources are recorded

Each launch app's registry entry (content/apps/<slug>.ts, typed in content/apps.ts) carries the licence record. The fields are:

Field	Type	Meaning
sources	ToolSource[] (content/apps/types.ts)	Display record: name, href (terms or licence page), licence (as the provider states it), use, optional credit (required attribution text), publisher, notices (links rendered beside the source)
sourceIds	string[]	Stable id per source, index-aligned with sources
sourceMeta	Record<id, SourceMeta>	Machine licence facts: licenceId (a LicenceId), licenceReadOn (ISO date the licence page was read), optional shareAlike, displayOnly, noticeRequired, decision
excludedSources	{ name, reason }[]	Sources left out on licence or terms grounds
dataPolicy.endpoints	AppEndpoint[]	Every host the app's pages contact: host, limiter service, operator, purpose, receives, consent (none, batch, always), terms, optional cspAlso, budgets, note, workspaceOnly
flags.shareAlikeData	boolean	The app ships share-alike data (only Molecule is true)
oracles	Oracle[]	Offline tools used to check numbers or build data; never shipped (see Dependencies and licences)

LicenceId is a closed union in src/components/suite/data/provenance.ts; its display names and URLs are in licenceTexts in content/apps/infra-texts.ts:

Id	Display name	Used by current sources
CC0-1.0	CC0 1.0	Yes
CC-BY-4.0	CC BY 4.0	Yes
CC-BY-SA-3.0	CC BY-SA 3.0	Yes (ChEMBL)
CC-BY-SA-4.0	CC BY-SA 4.0	No (the comment names ClinPGx)
CC-BY-NC-SA-3.0-IGO	CC BY-NC-SA 3.0 IGO	Yes (WHO stem book, display only)
EMBL-EBI-terms	EMBL-EBI terms of use	Yes
NCBI-public-domain	NCBI policies (public domain)	Yes
NCBI-no-restrictions-depositor-terms	No NCBI restrictions; depositor terms may apply	Yes
US-government-public-domain	US government work (public domain)	Yes
CTGOV-terms	ClinicalTrials.gov terms and conditions	Yes
MIT, BSD-3-Clause	Software licences	Yes
ISC, OFL-1.1, Apache-2.0	Software and font licences	No source uses them
GPL-3.0-or-later-buildtime	GPL-3.0-or-later (build-time tool only)	Yes (Blender, Molecular Nodes; display only)
cited-method	Method (cited)	Yes
cited-data	Data (cited)	Yes
curated-facts	Curated facts (each cited)	No
no-reuse-licence	No reuse licence (quoted with attribution)	Yes (PDB-101, display only)
own-content	Our own content	Yes (Plasmid enzyme table)

NCBI molecular data are not public domain (read 14 October 2026). NCBI places no restrictions on the use or distribution of sequence records, and submitters, or the data's country of origin, may claim patent, copyright or other rights; NCBI's public-domain statement covers only what is created by or for the US government on its site (docs/science/evidence/sequence-stage-literature-2026-10-14/ncbi-data-terms.md). NCBI-public-domain therefore stays only on NCBI's own work, such as the genetic-code tables. The display name of NCBI-no-restrictions-depositor-terms leaves out the country of origin; the CSO's proposed wording, "No NCBI restrictions; submitters or the data's country of origin may claim rights", is held for the General Counsel (docs/board/memos/2026-10-20-cso-codon-sources-read.md, ruling 7). Four copy sites still say "public domain" for NCBI sequence records: content/apps/sequence-toolkit.ts, two in src/components/tools/sequence-toolkit/examples.ts, and content/apps/plasmid-map.workspace.ts; they change with the CPO's words.

How the facts travel with results:

• provenanceSourceOf in content/apps/entry-helpers.ts joins a source with its sourceMeta and throws when the record is missing, so an export cannot carry a source with no licence record.
• Every export carries a ProvenanceBlock (src/components/suite/data/provenance.ts) whose sources[] hold the licence id, name, URL, read date, the registry credit as attribution, and shareAlike and displayOnly flags. See Storage and state for exports.
• attributionLines() adds fixed licence sentences, in ATTRIBUTION_ORDER (uniprot, alphafold, chembl, ctgov, openfda, fda), to CSV bundles built by buildTabularExport (src/components/suite/data/csv-bundle.ts). The texts are in content/apps/shared-texts.ts (attribution.*).
• When an exported source is share-alike and not display-only (needsShareAlikeNotice), the CSV bundle adds <base>.CHEMBL-LICENCE.txt with the CC BY-SA 3.0 notice (chemblNotice).
• noticeRequired is set on ChEMBL, ClinicalTrials.gov and PRISM 19Q4 and is copied into ProvenanceSourceEntry, but no code under src/ reads it. The notices that actually travel are the share-alike file and the automatic lines above.

The checks on these records are in scripts/licences.mjs (check 5, "the registry"): every sourceIds entry has a sourceMeta; a no-reuse-licence source has a decision or is displayOnly; every endpoint has an https:// terms page; every licence page was read within 365 days of the app's updated date (under npm test) or of today (with --release). No source currently carries a decision. See Dependencies and licences and Build, test and CI.

Three sets of data sit outside the registry and so outside these checks: the search catalogues (recorded in public/data/search/sources.json), the Education media (recorded in pipeline/education/catalog.json and content/education.ts) and the literature workspace (not recorded). They are covered in Data outside the app registry.

Inventory by provider

One row per provider and use. "Live" means fetched while the person works; "shipped" means the data is committed to the repository and served from this site; "cited" means values or methods taken from a publication and written into code or data; "build-time" means used only by pipeline scripts. App names: Protein (protein-explorer), Molecule (molecule-workbench), Pipeline (drug-pipeline-explorer), Cell (inside-a-cell), Calc (lab-calculators), Sequence (sequence-toolkit), Assay (assay-analyser), Plasmid (plasmid-map), Bioreactor (bioreactor-simulator).

Provider and source	Apps (source id)	How it is used	Hosts	Licence id	Read on	Flags
UniProt Consortium, UniProtKB	Protein, Sequence (uniprot); Cell, Plasmid (uniprot); search catalogue; server suggestions	Live in Protein and Sequence; shipped text in Cell; shipped cross-references in Plasmid; shipped search index; live through /api/search/proteins	rest.uniprot.org	CC-BY-4.0	2026-09-27 (Protein, Cell, Sequence); 2026-10-04 (Plasmid)
EMBL-EBI, PDBe API, UniPDB and SIFTS	Protein (pdbe)	Live	www.ebi.ac.uk	CC0-1.0 (PDB data; EMBL-EBI terms)	2026-10-05
RCSB PDB, Data API and model files	Protein (rcsb)	Live	data.rcsb.org, models.rcsb.org	CC0-1.0	2026-10-05
RCSB PDB coordinates	Cell (rcsb-pdb); Education	Shipped (trimmed BinaryCIF, stills, scenes)	none at run time	CC0-1.0	2026-10-05
AlphaFold DB (EMBL-EBI, DeepMind)	Protein (alphafold-db)	Live, including the PAE image (img-src)	alphafold.ebi.ac.uk	CC-BY-4.0	2026-10-05
AlphaMissense via AlphaFold DB	Protein (alphamissense)	Live, optional track	alphafold.ebi.ac.uk	CC-BY-4.0	2026-10-05
EBI Proteins API, variation	Protein (proteins-api)	Live, optional	www.ebi.ac.uk	EMBL-EBI-terms	2026-10-05	COSMIC-only records excluded
Open Targets Platform	Protein (open-targets)	Live (GraphQL)	api.platform.opentargets.org	CC0-1.0	2026-10-05	Drug data originates in ChEMBL (see Unsettled statuses)
ChEMBL 37 (EMBL-EBI)	Molecule (chembl); search catalogue; server lookups	Shipped library and example; shipped compound names; live through /api/search/molecule and /api/search/molecule-description	www.ebi.ac.uk (server)	CC-BY-SA-3.0	2026-10-05	shareAlike, noticeRequired
NCBI PubChem	Molecule (pubchem); Calc (pubchem); server suggestions	Live browser name lookup in Molecule; live through /api/search/compound, /api/search/compounds and /api/search/molecule-description; Calc's reagent identifiers shipped	pubchem.ncbi.nlm.nih.gov	NCBI-no-restrictions-depositor-terms	2026-10-05 (Molecule); 2026-10-06 (Calc)
NIH NCATS / FDA GSRS	Molecule, Calc (gsrs); search catalogue	Shipped (retatrutide's chemical definition, UNII NOP2Y096GV)	none	cited-data	2026-10-08
ClinicalTrials.gov API v2 (NLM)	Pipeline (ctgov)	Live; shipped dated fallback snapshots	clinicaltrials.gov	CTGOV-terms	2026-09-28	noticeRequired; 60-day snapshot expiry
openFDA drug label, Drugs@FDA, NDC	Pipeline (openfda)	Live; shipped in the snapshots	api.fda.gov	CC0-1.0	2026-10-05
openFDA complete response letters	Pipeline (fda-crl)	Shipped reduced snapshot; one live count	api.fda.gov	CC0-1.0	2026-10-05
FDA CDER NME and new biologic compilation	Pipeline (cder-nme)	Shipped snapshot	none	US-government-public-domain	2026-10-05
FDA CDER breakthrough therapy approvals	Pipeline (fda-breakthrough)	Shipped snapshot	none	US-government-public-domain	2026-10-05
FDA OCE Project Confirm	Pipeline (project-confirm)	Shipped snapshot, not shown	none	US-government-public-domain	2026-10-05
FDA surrogate endpoint table	Pipeline (fda-surrogate)	Shipped snapshot, not shown	none	US-government-public-domain	2026-10-05
WHO INN stem book 2024	Pipeline (who-stems)	Reference for the modality classifier; definitions not shipped	none at run time	CC-BY-NC-SA-3.0-IGO	2026-10-05	displayOnly
Europe PMC	Cell (europe-pmc); literature workspace	Build-time citation checks for Cell; live through literature routes	www.ebi.ac.uk (server)	EMBL-EBI-terms (Cell only)	2026-10-05	displayOnly (Cell)
RNAcentral	Cell (rnacentral)	Build-time identification of a tRNA	none	CC0-1.0	2026-10-05
PDB-101 Molecule of the Month	Cell (pdb-101)	Background reading; no text reused	none	no-reuse-licence	2026-10-05	displayOnly
NCBI genetic code tables (gc.prt 4.6)	Sequence (ncbi-genetic-codes)	Parsed into src/lib/seq/codes-data.ts at build time	none	NCBI-public-domain	2026-10-06
NCBI GenBank records	Plasmid (ncbi-genbank)	Shipped library parts, examples and primer checks; live record fetch on request	eutils.ncbi.nlm.nih.gov	NCBI-no-restrictions-depositor-terms	2026-10-05
ExPASy ProtParam documentation	Calc, Sequence (protparam)	Cited values (residue masses, Bjellqvist pK)	none	cited-data	2026-10-05
Nearest Neighbor Database, DNA terminal mismatches	Sequence (nndb-dna)	Cited values from one saved table	none	cited-data	2026-10-06	Licence line "To be checked"
IUPAC CIAAW atomic weights 2021	Calc, Sequence (ciaaw-2021)	Cited values	none	cited-data	2026-10-06
PRISM Repurposing 19Q4 (Broad Institute, figshare)	Assay (prism-19q4)	Shipped per-well readings for the guided walk	none	CC-BY-4.0	2026-10-06	noticeRequired
Disease Ontology (doid.obo, release 2026-09-30)	Search catalogue	Shipped condition names and parents	none	CC0-1.0 (in sources.json)	not recorded
OpenAlex	Literature workspace	Live through literature routes	api.openalex.org (server)	not recorded	not recorded
Cellosaurus (SIB), release 56.0 of 25 June 2026	Cell line records (cellosaurus, a suite dataset, no app)	Shipped snapshot loaded on demand; the release file downloaded at build time only	none at run time; ftp.expasy.org from pipeline/cellosaurus/fetch-release.py	CC-BY-4.0	2026-10-17	Attribution and changes made stated in the dataset record
Published papers, tables and manufacturers' manuals	All apps (cited-method, cited-data ids)	Cited methods and values	none	cited-method, cited-data	2026-10-05 to 2026-10-10
DNA ladder product sheets (two ladders, one supplier; the supplier, product, catalogue number, URL and sheet SHA-256 in pipeline/plasmid-map/ladders.csv)	Plasmid (ladder-sheets)	Cited: band sizes typed by hand into the CSV and src/lib/seq/ladders.ts, shipped in an on-demand chunk	none	cited-data; licence line "To be checked", held for the General Counsel (vendor ladder sheets and product names)	2026-10-17	A 100 bp ladder is not included: its sheet was not reachable on the supplier's site on 17 October 2026
The suite's own generated data	Assay, Plasmid, Bioreactor fixtures; Plasmid enzyme table	Shipped	none	MIT, own-content	2026-10-06 to 2026-10-07

Software that the registry lists as a source (Mol*, RDKit.js and its bundled InChI, OpenChemLib, 3Dmol.js, uqr, Blender, Molecular Nodes, Biotite, NumPy and SciPy) is covered on Dependencies and licences.

Live endpoints and what they receive

This is every host in a dataPolicy.endpoints list. These hosts form each app's Content Security Policy connect-src (see Security and network) and the privacy host table. Cell, Assay and Bioreactor declare no endpoints.

App	Host	Service key	Operator	Consent	Receives (registry wording)	Budget or note
Protein	rest.uniprot.org	uniprot	UniProt Consortium (EMBL-EBI, SIB and PIR)	none	your search text and UniProt accessions
Protein	www.ebi.ac.uk	ebi	EMBL-EBI	none	UniProt accessions and PDB ids
Protein	data.rcsb.org	rcsb	RCSB PDB (United States)	none	PDB ids
Protein	models.rcsb.org	rcsb-files	RCSB PDB (United States)	none	PDB ids
Protein	alphafold.ebi.ac.uk	alphafold-db	EMBL-EBI (AlphaFold DB)	none	UniProt accessions	Also in img-src
Protein	api.platform.opentargets.org	open-targets	Open Targets	none	the target's Ensembl gene id, or its UniProt accession when the entry gives no Ensembl id
Molecule	pubchem.ncbi.nlm.nih.gov	pubchem	NCBI, U.S. National Library of Medicine	none	compound names submitted to search and selected public compound identifiers
Molecule	www.ebi.ac.uk	chembl	EMBL-EBI	none	the ChEMBL identifier of the selected compound
Pipeline	clinicaltrials.gov	ctgov	U.S. National Library of Medicine	none	the condition and filters you search, NCT numbers taken from a label, and the NCT number of a trial whose page you open	FDA precedent: at most 1 request per product opened
Pipeline	api.fda.gov	openfda	U.S. Food and Drug Administration	none	the condition you search, application and product codes from openFDA's own answers, application numbers of a product page opened; the letter count is requested with no search	At most 12 requests per condition (measured weekly on the seven examples); 1 letter-count request per visit plus 1 per application with a newer letter; 1 label request per product opened
Calc	pubchem.ncbi.nlm.nih.gov	pubchem	NCBI, U.S. National Library of Medicine	none	the compound name searched or selected
Sequence	rest.uniprot.org	uniprot	UniProt Consortium (EMBL-EBI, SIB and PIR)	none	the search text submitted to UniProt and the selected accession; never the separate pasted sequence
Plasmid	eutils.ncbi.nlm.nih.gov	eutils	NCBI, US National Library of Medicine	always	the accession typed or armed by a link, and the IP address	1 request per accession; one at a time, at least 400 ms apart; workspaceOnly

Terms pages, as recorded in each endpoint's terms: UniProt https://www.uniprot.org/help/license; EMBL-EBI https://www.ebi.ac.uk/about/terms-of-use (Molecule's entry has a trailing slash); RCSB https://www.rcsb.org/pages/usage-policy; Open Targets https://platform-docs.opentargets.org/licence; NCBI https://www.ncbi.nlm.nih.gov/home/about/policies/; ClinicalTrials.gov https://clinicaltrials.gov/about-site/terms-conditions; openFDA https://open.fda.gov/license/.

How the code reaches each host

The registry declares hosts for disclosure and for the CSP. The code paths differ:

• Browser, direct. Protein's clients (src/components/tools/protein-explorer/, with UNIPROT_BASE = "https://rest.uniprot.org/uniprotkb" in uniprot.ts); Sequence's UniProt search and record fetch, which import Protein's searchProteins and loadEntry (src/apps/sequence-toolkit/views/sequence-search.tsx); Pipeline's CTGOV_API and OPENFDA clients (src/components/tools/drug-pipeline-explorer/ctgov.ts, openfda.ts, fetchers.ts, 20 s timeouts); Molecule's PubChem name lookup, a form-encoded POST to PUBCHEM_NAME_ENDPOINT (src/components/tools/molecule-workbench/lookup.ts, used by use-workbench.tsx); Plasmid's efetchUrl (src/lib/seq/eutils.ts).
• Through this site's server. Calc's PubChem lookups (src/components/tools/lab-calculators/panels/reagent-picker.tsx calls /api/search/compound and usePubchemSuggestions) and Molecule's ChEMBL lookups (/api/search/molecule, /api/search/molecule-description) go to same-origin routes. The registry wording "through this site" in those endpoints' purpose reflects this. The browser code of Calc never contacts pubchem.ncbi.nlm.nih.gov, and Molecule's browser code never fetches from www.ebi.ac.uk (it only builds links to ChEMBL pages, library.ts), so those two connect-src entries are wider than the code needs.
• Consent. Only Plasmid's E-utilities fetch goes through fetchWithTimeout with a consent token (src/components/tools/plasmid-map/eutils-client.ts). The request names the app as tool=drybench-plasmid and the maker's contact as email (from content/apps/maker.ts), never the person's, and sends no API key. DEFAULT_SERVICES in src/components/suite/net/limiter.ts gives pubchem consent: "always", but Molecule's lookup uses plain fetch, so that setting does not apply; the registry declares consent: "none" for it.

The limiter keys in DEFAULT_SERVICES (uniprot, pdbe, pdbe-kb, interpro, proteins-api, rcsb, alphafold, opentargets, ctgov, openfda, pubchem, eutils) are not the registry's service strings (ebi, rcsb-files, alphafold-db, open-targets, chembl). The registry keys are read only for display (src/components/suite/shell/network-indicator.tsx). Declared concurrency and spacing: ClinicalTrials.gov one lane at least 1,500 ms apart; PubChem two at least 250 ms apart; E-utilities one at least 400 ms apart; the others concurrency 1 to 4 with no spacing. See Security and network for retries and the breaker.

Server-side lookups and services

These calls run in route handlers, so they are not bound by an app's CSP and do not appear in any app's endpoint list unless the app declares the host for disclosure. Handler details are on Server, accounts and billing.

Route	Upstream	What the user's input contributes	Triggered by	Gate
/api/search/compounds	PubChem autocomplete	Typed text, 3 to 120 characters, debounced 250 ms (src/lib/search/use-pubchem-suggestions.ts)	Molecule query bar, Calc reagent picker, the command palette (src/components/suite/objects/palette.ts), literature search	None
/api/search/proteins	UniProt REST, four queries	Typed text, 2 to 120 characters, debounced 200 ms (src/lib/search/use-uniprot-suggestions.ts)	The command palette, literature search	None
/api/search/compound	PubChem PUG REST (POST)	A selected name, unless it maps to a curated structure	Calc reagent picker	None
/api/search/molecule	ChEMBL molecule/<id>.json	Only a ChEMBL id resolved from the local catalogue; the typed name is not forwarded	Molecule	None
/api/search/molecule-description	ChEMBL mechanisms or PubChem description	A CHEMBL<n> id or a numeric CID	Molecule scorecard	None
/api/literature, /api/literature/search, /discover, /fulltext	Europe PMC (www.ebi.ac.uk/europepmc/webservices/rest), OpenAlex (api.openalex.org)	Search queries and paper identifiers	Literature workspace	Origin check; quotas
/api/literature/extract, /plan, /api/study/summary	Anthropic Messages API (api.anthropic.com)	An abstract or full-text section; a search query; selected Study records (body up to 400,000 characters)	Literature workspace, Study summary	consent: true in the body for plan and summary; local development, or LITERATURE_AI_ENABLED=1 with account mode
/api/workspace/*	Supabase (SUPABASE_URL), Stripe	Email address for sign-in; Study backups; billing	Account mode only	Origin and scope checks

Points to note:

• The command palette is part of every app's shell (src/components/suite/overlay/command-palette.tsx uses useObjectCommands). Text typed into it on any app page is forwarded through the server to PubChem and UniProt once it reaches the minimum length. Apps whose endpoint list does not include those hosts (for example Bioreactor) therefore do not disclose them in their privacy host table. No mention of this was found in content/apps/security.ts, content/apps/shared-texts.ts or content/apps/suite.ts.
• OpenAlex requests carry Authorization: Bearer <OPENALEX_API_KEY> when that variable is set (src/lib/literature/sources.ts, src/lib/literature/search/providers.ts); publicResponse strips any api_key query parameter and allows only api.openalex.org and www.ebi.ac.uk.
• The full-text reader (parseFullText in src/lib/literature/fulltext.ts) refuses an article unless its licence URL is a Creative Commons by, by-sa, zero or public-domain-mark URL. Non-commercial and no-derivatives licences are refused with "This article's reuse licence is not supported by the in-app reader." The licence text and retrieval time are kept with each passage (FullTextPassage.licence).
• Next.js fetches the three Google fonts at build time and serves them from this site; Next's documentation (node_modules/next/dist/docs/01-app/03-api-reference/02-components/font.md) states that no requests are sent to Google by the browser. See Dependencies and licences.
• Hosting (Vercel) is covered in Deployment and environment.

App by app

Each table gives the source id, what it is used for, how it reaches the user, the licence id and read date from sourceMeta, and the attribution the registry asks for (credit, shortened here; the full text is in the app's file). "Display only" means the source is shown or consulted but never exported as rows.

Protein

content/apps/protein-explorer.ts. Ships no data files (pipeline/protein-explorer/README.md); everything is fetched live. compute: "browser+public-apis".

Id	Used for	Mode	Licence id	Read on	Attribution
uniprot	Search, names, function, location, features, curated variants; release shown; since Wave 4 the sequence version for a substitution check and both sequences (with version, MD5 and CRC64) for an alignment	Live	CC-BY-4.0	2026-09-27	UniProt Consortium, NAR 2025;53:D609-D617; automatic line with release
pdbe	Mapped PDB entries, observed residues, numbering, structure files	Live	CC0-1.0	2026-10-05	Each entry links to its PDBe page
rcsb	Atom counts; second host for structure files	Live	CC0-1.0	2026-10-05
alphafold-db	Predicted models and pLDDT	Live	CC-BY-4.0	2026-10-05	DeepMind copyright line; Jumper 2021; Bertoni 2026; other providers' credit (for example Viro3D)
alphamissense	Optional per-residue mean track with n; since Wave 4 the score for one checked substitution. Withheld for an entry whose file names a residue other than the model's	Live (the AlphaFold DB per-protein CSV)	CC-BY-4.0 (see below)	2026-10-05	DeepMind copyright line; Cheng 2023
proteins-api	Optional fuller variant list with clinical classifications	Live	EMBL-EBI-terms	2026-10-05	Notes COSMIC-only records excluded; ClinVar submitters may hold rights
open-targets	Drugs, clinical candidates, mechanisms, warnings	Live	CC0-1.0	2026-10-05	Buniello 2025; data version shown; notes ChEMBL origin
molstar	3D viewers	Vendored engine	MIT	2026-10-05	Sehnal 2021; display only

Protein computes sequence properties with ProtParam's conventions (protParamMethod in src/apps/protein-explorer/provenance.ts) as a method reference; unlike Calc and Sequence, it does not list ProtParam, Bjellqvist or Pace as sources.

Wave 4 added no host and no registry source. Two facts sit outside sourceMeta:

• AlphaMissense's licence. The registry's CC-BY-4.0 describes the AlphaFold DB per-protein CSV (AF-<acc>-F1-aa-substitutions.csv), which carries no licence header and whose terms were not re-read. The Zenodo bulk file AlphaMissense_aa_substitutions.tsv.gz (record 8208688, retrieved 11 October 2026), read only at pipeline time by substitution_reference.py, states "Licensed under CC BY-NC-SA 4.0 license" in its header; ten of its rows are kept as a verification input (pipeline/protein-explorer/fixtures/alphamissense-source/2026-10-11/), never shipped. App strings, the per-residue help text and the substitution export README still say CC BY 4.0. Held for the General Counsel; no string under src/ or content/ names the Zenodo file.
• BLOSUM62. The aligner's substitution matrix is compiled into the alignment worker (src/lib/protein/align/blosum62.ts), generated from NCBI's file https://ftp.ncbi.nlm.nih.gov/blast/matrices/BLOSUM62 (stored under pipeline/protein-explorer/fixtures/blosum62/ with its sha256) and checked against Biopython 1.88's copy. It has no sourceMeta entry; its redistribution terms are held for the General Counsel (D-0055). The alignment CSV names the matrix in its matrix column.

Molecule

content/apps/molecule-workbench.ts. flags.shareAlikeData: true; dataPolicy.wasm: true.

Id	Used for	Mode	Licence id	Read on	Attribution
chembl	2,197 approved small-molecule drugs (structures, names, approval years, withdrawal and route flags) in public/data/molecule-workbench/approved-drugs.json and default-example.json	Shipped; derived file shared under the same licence	CC-BY-SA-3.0	2026-10-05	ChEMBL release 37 (1 May 2026); Mendez 2019; Zdrazil 2024; doi:10.6019/CHEMBL.database.37; share-alike notice file on export
pubchem	Name lookup when the name is not in the library; compound descriptions for selected CIDs (briefly cached, not part of a recorded result)	Live (browser and server)	NCBI-no-restrictions-depositor-terms	2026-10-05	Kim 2025; NCBI disclaimer linked beside each PubChem result
rdkit	Descriptors, depictions, fingerprints, substructure search; QED and PAINS ported	Vendored engine and ported code	BSD-3-Clause	2026-10-05	RDKit and Novartis (QED.py) copyright lines; links to the QED notice and third-party notices
inchi	Standard InChIKeys	Bundled in RDKit.js	MIT	2026-10-05	Copyright (c) 2024 InChI Project
openchemlib	Structure editor, conformers, MMFF94s+ tables	Bundled engine and shipped tables (ocl-resources.json)	BSD-3-Clause	2026-10-05	cheminfo copyright line
3dmol	3D conformer display	Vendored engine	BSD-3-Clause	2026-10-05	University of Pittsburgh copyright; Rego and Koes 2015
qed-bickerton-2012, pains-baell-2010, ro5-veber, crippen-tpsa-morgan	Methods	Cited	cited-method	2026-10-05	Papers named in use
gsrs	Retatrutide's complete chemical definition	Shipped	cited-data	2026-10-08	NCATS / FDA GSRS, UNII NOP2Y096GV, definition 210e2d2c-…, retrieved 8 October 2026

pipeline/molecule-workbench/README.md records the ChEMBL-derived files as CC BY-SA 3.0 and keeps them separate from other data. Since Wave 4 the library file also records fingerprintPolicy, built and sameCompound, derived from the same ChEMBL structures.

The walk's ChEMBL series (Wave 4). content/walks/nearest.series.ts ships, in the walk's on-demand chunk, the 28 EGFR IC50 activity rows of ChEMBL document CHEMBL1134804 (Barker et al., Bioorg Med Chem Lett 2001; assay CHEMBL677210) as served by ChEMBL 37, with the CC BY-SA 3.0 notice in its header. They come from the write-once fixture pipeline/walks/nearest/fixtures/chembl1134804-egfr-ic50@ChEMBL_37.json (fetch-series.mts, release pinned with --expect-release). Loaded into a person's browser as a saved series (source block: ChEMBL, release, retrieval date 2026-10-11, licence, document), they say their source, release and licence with "share-alike" on screen, and the Series (CSV) README adds the share-alike line. The walk's opening structure is J3's erlotinib hydrochloride SMILES (PubChem CID 176871, D-0024). The Python RDKit test fixture (src/components/tools/molecule-workbench/fixtures/rdkit-reference.json) also carries ChEMBL-derived names, ids and SMILES under CC BY-SA 3.0, recorded in the file.

Pipeline

content/apps/drug-pipeline-explorer.ts. Snapshot mechanics, expiry and refresh are on Data pipeline.

Id	Used for	Mode	Licence id	Read on	Attribution
ctgov	Trial records: phase, status, dates, sponsor, enrolment, interventions, stop reasons	Live, with dated fallback snapshots in public/data/drug-pipeline-explorer/snapshots/ (retrieved 2026-10-05)	CTGOV-terms	2026-09-28	"Source: ClinicalTrials.gov, U.S. National Library of Medicine", processing date, and a statement of this site's modifications; snapshots older than 60 days are not shown
openfda	US-approved products whose label indications mention the condition	Live; shipped in the snapshots	CC0-1.0	2026-10-05	"Data from openFDA, U.S. Food and Drug Administration. Not endorsed by the FDA."
who-stems	Naming stems behind the modality classifier, checked stem by stem	Reference only; definitions not shipped	CC-BY-NC-SA-3.0-IGO	2026-10-05	WHO 2024 citation with licence; display only
cder-nme	FDA precedent: dates, review designation, expedited programmes, orphan designation	Shipped snapshot (precedent/cder-nme.json)	US-government-public-domain	2026-10-05	"Not endorsed by the FDA."
fda-breakthrough	FDA precedent: breakthrough approvals	Shipped snapshot	US-government-public-domain	2026-10-05	As above
fda-crl	FDA precedent: complete response letters reduced to application, company, date, type, centre and link	Shipped snapshot (crl.json); one live count	CC0-1.0	2026-10-05	As openFDA
project-confirm	Saved for the precedent table; not shown	Shipped snapshot	US-government-public-domain	2026-10-05
fda-surrogate	Saved for the precedent table; not shown	Shipped snapshot	US-government-public-domain	2026-10-05

Frozen search (Wave 4). pipeline/drug-pipeline-explorer/fixtures/ctgov/cystic-fibrosis@2026-10-11/ holds one ClinicalTrials.gov search (751 trials, API 2.0.5, data as of 2026-10-09) as received, with a sha256 manifest, as a test fixture for coverage_oracle.py and coverage.test.ts. It is never served; its manifest.json records that ClinicalTrials.gov's terms for it are held for the General Counsel (relates to Q-09 and R-04, the "no static copies" wording). The coverage details name other registries (EU CTIS, ISRCTN, ChiCTR, the WHO primary registries) as not searched; none is contacted.

Each snapshot file carries its own terms block (attribution, terms URL, modifications); each precedent file carries sourceUrl, licence, licenceReadOn, retrievedOn and each downloaded file's URL and SHA-256. The weekly verify_stems.py job downloads the WHO stem book PDF from iris.who.int for a reference check (.github/workflows/scheduled.yml); the CI job installs pypdf without a version pin. A precedent test fixture builder, pipeline/drug-pipeline-explorer/precedent/fixtures/build_section14.py, reads label PDFs from DailyMed (dailymed.nlm.nih.gov) and keeps snippets of at most 160 characters around each NCT number; DailyMed has no registry source record.

Cell

content/apps/inside-a-cell.ts. compute: "browser", no endpoints. Shipped data in public/data/inside-a-cell/ (eight BinaryCIF files, scenes.json, stills).

Id	Used for	Mode	Licence id	Read on	Attribution
rcsb-pdb	Coordinates and metadata of 3AFA, 8XSO, 6QDV, 7ZNK, 6Y0G, 6OLE, 7TUB, 2DN1	Shipped (trimmed by the pipeline)	CC0-1.0	2026-10-05	Entry ids; each step cites its primary paper
uniprot	Protein names, lengths and function notes behind the text	Shipped text	CC-BY-4.0	2026-09-27	UniProt Consortium 2025
europe-pmc	Checking citations; background abstracts (PMIDs 21195232, 24459735, 24196718, 20118940)	Build-time	EMBL-EBI-terms	2026-10-05	Display only
rnacentral	Identifying the tRNA in 6Y0G as E. coli tRNA-Phe (URS00005AA258)	Build-time	CC0-1.0	2026-10-05
pdb-101	Background reading; no text reused	Reference	no-reuse-licence	2026-10-05	David S. Goodsell and the RCSB PDB; display only
molstar	3D viewer and MolViewSpec scenes	Vendored engine	MIT	2026-10-05	Sehnal 2021
blender, molecular-nodes	Rendering the stills	Build-time tool	GPL-3.0-or-later-buildtime	2026-10-05	Display only; outputs stated as not covered by the GPL
biotite, numpy-scipy	Reading, trimming and measuring structures	Build-time tool	BSD-3-Clause	2026-10-05	Display only

Calc

content/apps/lab-calculators.ts.

Id	Used for	Mode	Licence id	Read on	Attribution
ciaaw-2021	Atomic weights as exact decimals	Cited	cited-data	2026-10-06	Prohaska 2022
goldberg-2002	Buffer pK, ΔrH°, ΔrCp° for 34 reactions; equation 12	Cited	cited-data	2026-10-06	Goldberg, Kishore, Lennen 2002
pace-1995	ε280 coefficients	Cited	cited-method	2026-10-05	Pace 1995
a260-conventions	A260 rules of thumb (dsDNA 50, RNA 40, ssDNA 33 µg/mL per unit at 1 cm); the a260-rules chip (SCI-146)	Cited	cited-data	2026-10-17	Thermo Fisher NanoDrop One FAQ, MCS-TN1315-EN and conversions page; IDT; Cavaluzzi and Borer 2004
protparam	Residue masses and Bjellqvist pK values	Cited	cited-data	2026-10-05	Gasteiger 2005
pubchem	CIDs, InChIKeys and formulas of the 75 shipped reagents (public/data/lab-calculators/reagents.<hash>.json); live suggestions and lookups through the server	Shipped; live via server	NCBI-no-restrictions-depositor-terms	2026-10-06	Kim 2025
uqr	QR code on stock labels	Bundled library	MIT	2026-10-06	Anthony Fu copyright line
gsrs	Retatrutide definition	Shipped	cited-data	2026-10-08	As Molecule

Sequence

content/apps/sequence-toolkit.ts.

Id	Used for	Mode	Licence id	Read on	Attribution
ncbi-genetic-codes	The 27 translation tables	Built into code	NCBI-public-domain	2026-10-06	NCBI Taxonomy, gc.prt 4.6
protparam	Residue masses and pK values	Cited	cited-data	2026-10-05	Gasteiger 2005; "not affiliated"
bjellqvist-1993, pace-1995, owczarzy-2004, owczarzy-2008	Methods	Cited	cited-method	2026-10-05 to 2026-10-06	Papers named
santalucia-1998, santalucia-hicks-2004, bommarito-2000, ciaaw-2021	Thermodynamic and mass values	Cited	cited-data	2026-10-06	Papers named
nndb-dna	ΔG°37 of the first hairpin mismatch, one table saved in pipeline/sequence-toolkit/nndb/ (SHA-256 recorded)	Cited	cited-data	2026-10-06	Turner and Mathews 2010; Mittal 2024; licence line "To be checked"
uniprot	Explicit protein search and canonical sequence lookup	Live	CC-BY-4.0	2026-09-27	UniProt Consortium 2025

Assay

content/apps/assay-analyser.ts. No endpoints; dataPolicy.wasm: true for RDKit.

Id	Used for	Mode	Licence id	Read on	Attribution
hill-1910-ritz-2015, levenberg-marquardt, zhang-1999, sebaugh-2011, qpcr-pfaffl, qpcr-qbase	Methods	Cited	cited-method	2026-10-05 to 2026-10-10	Papers named
graphpad-guides	Prism guides read as a behavioural reference; no text copied	Cited	cited-method	2026-10-06	Trade-mark and non-affiliation statement
rdkit	Structures beside potencies when a SMILES column is present	Vendored engine	BSD-3-Clause	2026-10-06	Link to third-party notices
assay-fixtures	The worked MTT example and 33 synthetic curves	Shipped, generated	MIT	2026-10-06	The suite's own scripts
prism-19q4	Per-well readings for erlotinib and controls, HCC827, HTS002, three plates (src/components/tools/assay-analyser/examples/prism-erlotinib-hcc827.data.ts)	Shipped	CC-BY-4.0	2026-10-06	Corsello, Kocak, Golub (2019), figshare doi:10.6084/m9.figshare.9393293.v4; publisher Broad Institute; CC BY 4.0 notice link

pipeline/assay-analyser/make-prism-example.mts copies the readings by an allow-list (plate, well, dose, perturbation type, reading) and writes no compound name, sample id or Drug Repurposing Hub field.

Plasmid

content/apps/plasmid-map.ts. Shipped data in public/data/plasmid-map/ (versioned enzymes, features and primers files; pUC19 and pBR322 examples).

Id	Used for	Mode	Licence id	Read on	Attribution
ncbi-genbank	50 library parts, pUC19 (L09137.2) and pBR322 (J01749.1) examples, primer binding checks, and records fetched on request	Shipped; live on request	NCBI-no-restrictions-depositor-terms	2026-10-05	Records cited by accession and version; NCBI policies link
uniprot	Cross-referenced protein entries for coding parts	Shipped	CC-BY-4.0	2026-10-04	UniProt Consortium 2025
mcclelland-1994	Dam and dcm sensitivity, Table I	Cited	cited-data	2026-10-06	McClelland, Nelson, Raschke 1994
enzyme-table	223 enzymes typed by hand from published facts	Own content	own-content	2026-10-06	Enzyme table version 1
smith-waterman-gotoh, geier-modrich-1979	Methods	Cited	cited-method	2026-10-06	Papers named
primer-manuals	Names of shipped primers from Thermo Fisher and Promega manuals; no text copied	Cited	cited-data	2026-10-06	Manual numbers named
plasmid-fixtures	Oracle values and synthetic .dna files	Shipped, generated	MIT	2026-10-06	The suite's own scripts

Bioreactor

content/apps/bioreactor-simulator.ts. No endpoints.

Id	Used for	Mode	Licence id	Read on	Attribution
monod-andrews, pirt-luedeking-piret, shampine-reichelt-1997, van-t-riet-yawalkar	Growth, maintenance, solver, kLa	Cited	cited-method	2026-10-05 to 2026-10-06	Papers named; the non-coalescing kLa constants are marked Unverified
benson-krause-usgs	Oxygen solubility	Cited	US-government-public-domain	2026-10-06	USGS memo 2011.03
preset-values	Preset parameters from eighteen papers	Cited	cited-data	2026-10-06	Each value's paper, table and DOI on its preset page
bioreactor-fixtures	Oracle fixtures and golden runs	Shipped, generated	MIT	2026-10-07	The suite's own scripts

Data outside the app registry

Search catalogues

scripts/build-search-catalogs.mjs and scripts/build-search-details.mjs write content-hashed files to public/data/search/ (see Data pipeline). Their record is public/data/search/sources.json (generated 2026-10-07):

Catalogue	Source	Licence recorded	Count	Notes
conditions.<hash>.json, condition-details.<hash>.json	Disease Ontology doid.obo, release 2026-09-30	CC0-1.0	12,335	Active terms and exact synonyms; parent labels for classification only
human-proteins.<hash>.json, protein-seeds.<hash>.json	UniProtKB stream query, reviewed human entries	CC-BY-4.0	20,431 (120 seeds)	No UniProt release is recorded
compounds.<hash>.json	ChEMBL 37 approved library and named clinical-stage entities; brand names from the shipped openFDA snapshots	CC BY-SA 3.0	16,784	Served as a public file
compound-details.<hash>.json	Formulas and masses computed with RDKit 2026.03.6 from the shipped structures, GSRS retatrutide and PubChem CID 56843331 (semaglutide)	"ChEMBL-derived rows retain CC-BY-SA-3.0 attribution"

The catalogues feed the command palette, object pages, the reagent picker and literature subjects. They have no sourceMeta entry, and the share-alike notice sits in sources.json beside the files rather than in them. Both points are open (Q-26 and the held item on the search catalogues; see Held for the General Counsel).

Cellosaurus: the cell line records

E10 of the enterprise-standard actions (D-0099; the CSO's ruling F5, the CTO's ruling 4(c), the CPO's ruling 7, all 17 October 2026). The source is recorded once, as the suite dataset cellosaurus in content/apps/services.ts (suiteDatasets), because no app owns the cell-line object. The record carries contactedFrom: "build" and buildHost: "ftp.expasy.org": only the pipeline script downloads from that host, so it is in no connect-src, no app's endpoint list and no server services list (content/services.test.ts, "a dataset downloaded at build time…"). The security page lists it under "Data shipped with the suite".

Field	Value
Licence	CC BY 4.0 (CC-BY-4.0), read on https://www.cellosaurus.org/description.html ("Licensing": "We have chosen to apply to Cellosaurus the Creative Commons Attribution 4.0 International License (CC BY 4.0)") on 17 October 2026. The release file's own header states the same licence and asks for credit, a link to the licence and an indication of changes
Release	56.0, "Last update: 25-June-2026" (the release file's header); 168,970 cell lines in the release notes
Raw file	https://ftp.expasy.org/databases/cellosaurus/cellosaurus.txt, 122,297,334 bytes, SHA-256 b225da548b65e8db10597759bc152c78b1b9d23e123494744510d7569cf4ab3b, retrieved 17 October 2026; not committed. The fetch record is pipeline/cellosaurus/releases/56.0.json
Attribution	The dataset's credit (Cellosaurus, SIB; Bairoch 2018) and note (changes made: fields reduced, names normalised for the index)
Held for the General Counsel	The licence class and the attribution wording, with the other E-track sources (the CPO's and CTO's memos of 17 October 2026, "Held for the General Counsel"); to be added to the held list in docs/board/open-questions.md, which the F track holds while it runs

How the snapshot is built, served and kept fresh is on Data pipeline.

Education media

pipeline/education/molecular.py renders ten posters, three guide videos and scenes.json into public/data/education/ from RCSB PDB entries 6Y0G, 7PFO, 6QDV, 3KTQ, 6OQR, 1EFA, 4UN3, 1EHZ, 1UBQ and 3PTB. pipeline/education/catalog.json (version 4) states the provenance as "RCSB PDB experimental coordinates (CC0)" and the renderer as Blender 5.2.2 with Molecular Nodes 520.2.0; pipeline/education/README.md states that their GPL licences do not apply to the rendered media. The tools' sources in content/education.ts are links with a label and detail and carry no licence id or read date; the education tools have no registry entry, so scripts/licences.mjs does not check them and does not list their GPL build tools.

Literature workspace

The literature workspace and the AI routes contact Europe PMC, OpenAlex and the Anthropic API from the server (see Server-side lookups and services). None of these is declared in any registry entry, so they do not appear on the hosts or privacy pages; this is Q-26, owned by the CTO and accepted for now by the CEO on 10 October 2026. OpenAlex has no licence id or read date anywhere in the code; research §10.1 classes OpenAlex as "Facts / CC0" (research, not checked against a licence record in the code).

Data used only to build or check

Data	Where	Licence as recorded
Raw ProtParam responses for 22 proteins	pipeline/sequence-toolkit/protparam/	"ProtParam terms 'To be checked'" (pipeline/sequence-toolkit/README.md, the protein.json fixture)
UniProt entries for 19 accessions	pipeline/sequence-toolkit/inputs/uniprot/	CC BY 4.0, release 2026_03
NCBI and UniProt records for Plasmid	pipeline/plasmid-map/records/	As the registry
PRISM candidate data sets for the J3 walk	pipeline/walks/j3/	Nothing here ships (Data pipeline); the landing page's RDKit depiction that shipped from here on 20 October 2026 was removed the same day, when the guided example was simplified at the CEO's request
Rejected Assay reference data (Hafner 2017 Dryad, CC0; PLOS ONE 2024 S21, CC BY 4.0)	pipeline/assay-analyser/README.md	Recorded as not used
WHO stem book PDF	Downloaded by verify_stems.py at run time	CC BY-NC-SA 3.0 IGO, reference only
DailyMed label PDFs	build_section14.py	Not recorded
AlphaFold DB entries, AlphaMissense per-protein CSVs and UniProt sequences for five proteins (gzipped, sha256 recorded)	pipeline/protein-explorer/fixtures/alphamissense/<acc>@2026-10-11/	Recorded in each expected.json as CC BY 4.0 (AlphaMissense, AlphaFold DB, UniProt)
Ten rows of the Zenodo AlphaMissense bulk file, with its header	pipeline/protein-explorer/fixtures/alphamissense-source/2026-10-11/	The file's header: CC BY-NC-SA 4.0; held for the General Counsel
UniProt JSON for eight accessions (release 2026_03)	pipeline/protein-explorer/fixtures/alignment/2026-10-11/inputs/	CC BY 4.0
NCBI's BLOSUM62 file	pipeline/protein-explorer/fixtures/blosum62/	Held for the General Counsel
A frozen ClinicalTrials.gov search	pipeline/drug-pipeline-explorer/fixtures/ctgov/	ClinicalTrials.gov terms; held for the General Counsel
ChEMBL 37 EGFR IC50 rows of CHEMBL1134804	pipeline/walks/nearest/fixtures/	CC BY-SA 3.0; shipped as the walk's series (above)
FDA Orange Book data files (products.txt, patent.txt, exclusivity.txt), captured daily	The orphan branch data/exclusivity, written by capture-patent.yml (pipeline/patent-exclusivity/)	US-government-public-domain registry id; FDA website policies read 18 October 2026, qualified by “Unless otherwise noted”; source-specific classification and attribution held for the General Counsel (D-0077)
FDA Purple Book data download (monthly CSV), captured on change	Same branch	Same policy/read date; September 2026 CSV confirmed in the pinned capture
FDA Paragraph IV patent certifications XLSX, normalised as tab-separated text on change	Same branch	Same policy/read date; 9-28-2026 workbook confirmed in the pinned capture

Third-party services that are not data sources

Service	Role	Where configured	What it receives
Vercel	Hosting	Deployment and environment	All requests to the site
Supabase	Accounts, Study backups, the literature quota RPC (account mode only)	src/lib/workspace/server.ts; SUPABASE_URL	Email address for sign-in links; backups; SHA-256 hashes of account ids for quotas
Stripe	Subscription billing (account mode only)	src/lib/workspace/billing.ts	Checkout and customer-portal sessions
Anthropic	AI extraction, search plans and Study summaries	src/lib/literature/anthropic.ts	Text the person asked to process
Google Fonts	Font files fetched at build time by next/font/google	src/lib/fonts.ts	Build-time requests only

Details and enabling conditions are on Server, accounts and billing.

Excluded sources

Every excludedSources entry in the registry, with the reason as recorded. These names may appear in copy and are not used as data.

App	Excluded	Reason (registry)
Protein	COSMIC	Commercial product or public website use needs a commercial licence; COSMIC-only variant records are left out
Protein	DrugBank	Non-commercial licence; drug data comes from Open Targets
Protein	KEGG	Non-academic use needs a commercial licence
Protein	OMIM	Commercial use needs a licence
Protein, Cell	AlphaFold 3 outputs	Terms allow non-commercial use only
Molecule	DrugBank	Non-commercial licence; library built from ChEMBL
Molecule	WHO ATC index	Terms forbid copying or distribution for commercial purposes; map coloured by ChEMBL route flags
Molecule	Open Babel	GPL would extend to the app's code once shipped in the browser
Pipeline	WHO ICTRP web service	Research use only, no local storage, not part of a paid service
Pipeline, Cell	DrugBank	Non-commercial licence
Pipeline	Citeline and Evaluate	Subscription databases; never scraped
Pipeline	Friends of Cancer Research breakthrough CSV	No reuse licence; designations taken from FDA's lists
Pipeline	CIRS R&D Briefing tables and figures	Copyrighted; nothing reproduced
Pipeline	FuzeBio and ph3.bio CRL databases	Third-party compilations with no licence; openFDA is the source
Pipeline	Cortellis Regulatory Intelligence, PharmaPendium, Vivpro, Pink Sheet, Obsidian RI	Subscription services; never scraped
Pipeline	Drug label text at scale	Label text is the sponsor's; only NCT numbers are taken from a label
Calc	CAS Registry Numbers	Proprietary identifiers; PubChem CIDs and InChIKeys used
Calc	phbuffers.org database	Licence not stated; linked instead
Calc	GPL primer-design code	GPL would extend to the app's code
Calc, Sequence	Biopython residue and other tables	Not copied; Biopython is an offline oracle only
Calc	Vendor formula-weight tables	Vendor atomic weights and lot data; IUPAC 2021 used
Calc	Cavaluzzi and Borer 2004 ε260 table	Not checked against the paper; oligonucleotide ε260 not computed
Sequence	Primer3 (ntthal, oligotm)	GPL-2; offline oracle only, parameter files never copied
Sequence	Sequence Manipulation Suite (SMS2)	GPL-3; behaviour reference only
Sequence	EMBOSS	GPL; behaviour reference only
Sequence	CRISPOR	Academic-only licence; not run even as an oracle
Sequence	REBASE and NEB enzyme data	Terms unverified; digests are Plasmid's job
Sequence	IDT, NEB and Thermo Tm calculators	Vendor terms; comparisons only
Sequence	Kazusa and CoCoPUTs codon usage	Terms not stated
Sequence	Benchling	Never used
Assay	drc, GRmetrics and nplr as dependencies	GPL; offline oracles only
Assay	GraphPad Prism help text, option names and checklists	GraphPad's copyright; facts only
Assay	AAT Bioquest, ConductScience, BioProcess Tools, MyAssays	Competitors; named in comparisons only
Assay	ChEMBL potency rows	Share-alike would attach to rows shown or exported; links only
Assay	Vendor plate-reader sample files	Vendor copyright; generated files used
Assay	Hafner et al. 2017 (Dryad, CC0) as reference curves	Normalised means only, no wells or controls
Assay	Drug Repurposing Hub sample annotations	Non-commercial; none of its fields used
Plasmid	Addgene maps, annotations, sequences, primer table	Non-commercial use only; no reuse licence
Plasmid	FPbase	CC BY-SA 4.0 would make the library share-alike; shipping it as a separate file is the CEO's decision
Plasmid	The iGEM Registry	Terms not read
Plasmid	SnapGene feature database and SnapGene-annotated records	Proprietary
Plasmid	GPL plasmid-annotation tools and their databases	GPL-3.0 code; databases derived from SnapGene's
Plasmid	Bulk restriction-enzyme downloads	Terms unconfirmed; table typed by hand
Plasmid	NEB data (NEBcutter outputs, NEB tables)	Not reusable; NEBcutter a manual cross-check only
Plasmid	SeqViz and Open Vector Editor	Own SVG renderer; Open Vector Editor has no licence field
Bioreactor	bioprocesstools.com	Terms forbid republishing; qualitative reference only
Bioreactor	bioreactor-sim	No licence stated
Bioreactor	Textbook figures and parameter tables	Compilation copyright; values cited to primary papers
Bioreactor	Vendor vessel and impeller documentation	Makers' copyright
Bioreactor	FedBatchDesigner	MIT, but kept as a reference by policy
Bioreactor	simulations4all	Terms unknown

scripts/removed-sources.mjs (run in CI) fails on any mention outside docs/ and .claude/ of the BIO, Informa Pharma Intelligence and QLS Advisors success-rate tables, removed under D-0011, except two exact changelog sentences kept as history.

Licence statuses that are not settled

Facts recorded in the repository that a reviewer should read before relying on a source commercially. None is a legal conclusion.

Item	Recorded status	Where
NNDB DNA terminal-mismatch table	"Values cited from the public table; licence to be checked"; licenceId: "cited-data" until the General Counsel reads it	content/tools/sequence-toolkit.ts, content/apps/sequence-toolkit.ts, pipeline/sequence-toolkit/nndb/README.md
ExPASy ProtParam web form (oracle)	"SIB terms of use (To be checked)"	Sequence oracles, pipeline/sequence-toolkit/README.md
PDB-101	no-reuse-licence, display only, no text reused	Cell sourceMeta
WHO stem book	CC BY-NC-SA 3.0 IGO, reference only; downloaded weekly by a CI check	Pipeline sourceMeta, scheduled.yml
GSRS	cited-data for a substance definition	Molecule, Calc; flagged in Q-26
PubChem	No NCBI restrictions; depositors may claim rights	Molecule, Calc
Open Targets	Registered as CC0; the source credit notes ChEMBL origin. Research §10.2 says to treat Open Targets' ChEMBL components as BY-SA. The shared text attribution.openTargetsChemblPosition ("Exports keep the ChEMBL attribution line as good practice") is not referenced by any code	content/apps/protein-explorer.ts, content/apps/shared-texts.ts
ChEMBL users' data position	attribution.chembl.userData is marked "a position pending legal review … not to be shown in a sold product until the review is recorded"	content/apps/shared-texts.ts
ClinicalTrials.gov	Terms ask for attribution, currency, processing date and modifications; snapshots hidden after 60 days; static-copy wording on the linking page	Pipeline; Q-09; held item on Pipeline's objects
AlphaMissense	Registry: CC BY 4.0 for the per-protein CSV (read 2026-10-05). The Zenodo bulk file's header: CC BY-NC-SA 4.0 (read 2026-10-11). Product-page copy says the scores are CC BY 4.0 "which allows commercial use with attribution" (content/apps/protein-explorer.ts)	content/apps/protein-explorer.ts; pipeline/protein-explorer/fixtures/alphamissense-source/2026-10-11/about.json
BLOSUM62	No licence record; generated into code from NCBI's file	src/lib/protein/align/blosum62.ts; D-0055
Licence read dates	Earliest is 2026-09-27 (UniProt in Protein, Cell, Sequence). node scripts/licences.mjs --release starts failing on those records after 27 September 2027	scripts/licences.mjs READ_WITHIN_DAYS = 365

Open licensing items held for the General Counsel

The General Counsel is paused until v1 goes live (D-0010) and compliance checks are run at the pre-live pass (D-0014). The data-related items from docs/board/open-questions.md are:

Item	Status in the register
Q-03: what a paid Molecule bundle may include under ChEMBL's share-alike licence	Open; held for the v1 go-live review
Q-09: whether ClinicalTrials.gov terms allow stored record history in a paid product; AACT as substitute	Open; held
Q-10: IMGT terms and ANARCI (before any antibody mode)	Open; held
Q-11: MedDRA display model (only if FAERS work returns)	Open; held
Q-13: EU CTIS and HAS reuse terms	Open; held
Q-17: serving source data to LLM clients without per-field metadata and terms	Open (CTO-owned, GC consulted)
Q-26: hosts and sources that belong to no app (literature hosts, shipped ChEMBL names without sourceMeta, UniProt index with no release, GSRS as "cited-data")	Open (CTO-owned); accepted for now by the CEO on 10 October 2026
The licence id recorded for every source (sourceMeta), including PDB-101, the WHO stem book, PubChem, Europe PMC and the Proteins API	Held 5 October 2026
Pipeline's objects: a per-object ClinicalTrials.gov facts cache in the person's store, and whether a later sync changes the answer	Held 6 October 2026
H-01 to H-09: FDA precedent (CRL PDF links naming officials, excluded letter fields, the "not regulatory or legal advice" wording, the live letter check design, nominative naming of excluded services, the Friends of Cancer Research permission, label snippets in fixtures, the ClinicalTrials.gov modification wording, licence classes of the five FDA sources)	Held 5 October 2026
PRISM 19Q4 and the Drug Repurposing Hub: attribution and changes-made text, whether citing the Hub's sample record counts as use under its non-commercial term, Hub-derived columns in PRISM's files	Held 6 October 2026 (with the CMO's and CPO's extensions)
Plasmid: REBASE's openness condition and citation request, NEB-hosted primer documentation, publishing synthetic .dna fixtures	Held 6 October 2026
The search catalogues as public files: whether attribution must travel inside each file, and share-alike terms for a publicly served derivative	Held 10 October 2026
Sequence's registry naming GPL tools (Primer3, SMS2, EMBOSS) and the Primer3 ntthal conventions the engine follows	Held 6 October 2026
Audit evidence retention (third-party source excerpts in Git history)	Held 7 October 2026
Wave 4 sources and wording: BLOSUM62 redistribution and the exemption to name EMBOSS Needle's convention in copy; whether the AlphaFold DB per-protein AlphaMissense CSV carries CC BY 4.0 or the bulk file's CC BY-NC-SA 4.0, and the attribution in exports; ChEMBL share-alike when a person's series export mixes their rows with nearest-drug names and SMILES (relates to Q-03), and on the walk's saved example series; frozen ClinicalTrials.gov responses kept as fixtures; erlotinib hydrochloride's PubChem SMILES under NCBI's depositor terms; Barker et al. and "ZD1839" named in copy; individual sponsors named in Pipeline's on-screen sponsor chart; the FDAAA phase 1 coverage sentence as regulatory copy	Held 10 and 11 October 2026
The enterprise review's data items (docs/reviews/2026-10-17-enterprise-review/README.md, section 11): GPL oracle outputs published under public/verification/ and inside a proposed offline bundle; Cellosaurus, UniChem and ChEBI licence classes and attribution lines, and DrugBank identifiers as nominative use, for proposed features; ClinicalTrials.gov stored history for a proposed watch (Q-09); consent for contributed instrument files. The register's rows that could remove a feature at the pre-live pass (AlphaMissense, ChEMBL share-alike, the Drug Repurposing Hub, the Prism naming and .pzfx importer, GPL oracle outputs, the codon tables, the WHO stem book, ClinicalTrials.gov history) now carry the review's estimate of what a ruling against them would cost	Held 17 October 2026

Q-26 names src/lib/search/compounds-data.ts, which no longer exists; the ChEMBL names are now in public/data/search/compounds.<hash>.json.

Research risk R-04 ("Licence exposure: CT.gov 'no static copies', ChEMBL share-alike, Open Targets components, MedDRA in FAERS, GPL in bench tools") is owned by the General Counsel.

Research context

This section summarises docs/research.md §10, "Data sources and licensing". It is research done on 4 October 2026 by reading terms pages, labelled there as not legal advice. It has not been re-verified for this page, and where it disagrees with the registry the registry records what the code does.

• §10.1 Green (public domain, CC0 or CC BY; attribution only): openFDA (CC0, with MedDRA inside FAERS excepted), fda.gov content, UNII/GSRS, PDB, UniProt and AlphaFold DB (AlphaFold 3 outputs excluded), Crossref and OpenAlex ("Facts / CC0"), NCBI including PubChem ("PubChem allows 5 requests a second"), EMA, and others the suite does not use.
• §10.2 Amber (usable on a condition): ClinicalTrials.gov (attribute, keep current, show processing date, state modifications); NLM PubMed/MEDLINE and DailyMed ("Courtesy of the U.S. National Library of Medicine"); ChEMBL and other share-alike data, kept in separate files; Open Targets, treated as BY-SA for its ChEMBL components; PMC and preprints (licence varies by article); WHO INN lists and stem book (CC BY-NC-SA 3.0 IGO).
• §10.3 Red (not without a negotiated licence): WHO ICTRP, WHO ATC/DDD, DrugBank full data, Semantic Scholar, IUPHAR/BPS GtoPdb for commercial organisations, AlphaFold 3 outputs, the BIO/Informa/QLS tables, COSMIC, OncoKB and others.
• §10.4 ClinicalTrials.gov detail: the data "carry an international copyright outside the United States"; the linking page asks for no static copies of studies or search results; the API rate limit is unverified.
• §10.5 Five traps: MedDRA inside CC0 FAERS; aggregators passing on their sources' terms; restricted vocabularies inside open data; non-commercial clauses on public-looking sources; copyrighted text inside public-domain records. It also names Primer3, SMS2, drc, GRmetrics, nplr and pLannotate as GPL and CRISPOR as academic-only, to be used only as offline oracles.
• §10.6 Unverified items include the Europe PMC copyright page, the ClinicalTrials.gov API rate limit, E-utilities limits with a key, and for the bench apps REBASE, Kazusa and CoCoPUTs, Addgene, FPbase and the iGEM Registry.

Where the code follows it: ChEMBL data is kept in separate files with a share-alike notice; snapshots expire after 60 days; WHO ATC, DrugBank, ICTRP and AlphaFold 3 outputs are excluded; no FAERS or MedDRA data is used; GPL tools are oracles only.

Gaps and divergences found

Finding	Location
ATTRIBUTION_ORDER and attributionLines use the id alphafold, but the registry id is alphafold-db; a CSV bundle with an AlphaFold DB source would not get the automatic AlphaFold line. No current CSV export includes that source (figures carry the credit in the provenance block), so this is latent	src/components/suite/data/provenance.ts:328; src/apps/protein-explorer/exports.ts
noticeRequired is recorded and passed through but read by no code	content/apps.ts:157; content/apps/entry-helpers.ts:72
attribution.openTargetsChemblPosition is defined but unused	content/apps/shared-texts.ts:126
The command palette forwards typed text to PubChem and UniProt through the server on every app page, including apps whose endpoint list does not name those hosts	src/components/suite/objects/palette.ts:99-100
Calc declares pubchem.ncbi.nlm.nih.gov and Molecule declares www.ebi.ac.uk, but their browser code reaches those services only through /api/search/*	content/apps/lab-calculators.ts, content/apps/molecule-workbench.ts
DEFAULT_SERVICES.pubchem has consent: "always" while the registry says none; the limiter setting is unused because Molecule calls PubChem with plain fetch	src/components/suite/net/limiter.ts:57
Registry endpoint service keys differ from the limiter's keys	content/apps/*.ts; src/components/suite/net/limiter.ts:46-60
The literature hosts, the search catalogues and the Education sources have no licence id or read date in a checked record	Q-26; content/education.ts
The UniProt search index records no release	public/data/search/sources.json
Q-26 cites a file that no longer exists	docs/board/open-questions.md (Q-26)
The weekly WHO stems check installs pypdf unpinned; the precedent requirements pin pypdf==6.19.0	.github/workflows/scheduled.yml (stems job); pipeline/drug-pipeline-explorer/precedent/requirements.txt
DailyMed is read by a fixture builder with no source record	pipeline/drug-pipeline-explorer/precedent/fixtures/build_section14.py:39
Protein's registry entry and product page were not updated for the Wave 4 substitution check: AlphaMissense is still described as "an optional track", with a commercial-use sentence that the bulk file's header now puts in question	content/apps/protein-explorer.ts (features, page)
BLOSUM62 ships in the alignment worker with no sourceMeta or other licence record	src/lib/protein/align/blosum62.ts

Adding or changing a source

1. Read the terms page and record the source in the app's content/apps/<slug>.ts: sources (with credit where the licence asks for exact wording), sourceIds, and sourceMeta with licenceId and licenceReadOn. Set shareAlike for share-alike data and displayOnly for references. During development the licence line may read "To be checked" (D-0014).
2. If the app contacts a new host, add an AppEndpoint with terms, receives and the right consent; this widens the CSP and the privacy table (see Registry and content).
3. If the licence is excluded, add an excludedSources entry with the reason.
4. For shipped data, follow Data pipeline: provenance inside the file, a shape test, and a manifest for versioned data.
5. Run npm test (which runs scripts/licences.test.mjs) and npm run check-licences. A GPL dependency, or a feature built on a source that cannot ship commercially, means a rewrite at the pre-live pass, so say so when proposing one.

Public reference workflows (16 October 2026)

Reference routes cite existing sources and primary papers per entry, including licence/status badges. The selected trial and FDA captures carry retrieval/source provenance. New redistribution/licence questions remain on the held General Counsel list; no new legal conclusion is asserted. See Public reference workflows for the shared route, state, source and export contracts.

Patent capture provenance, 18 October 2026

The first real Patent store uses the exact five normalised members in data/exclusivity commit 2d0b7be911499788d58924e6a16b145eeab5cb01. The source receipt preserves each member's hash, bytes, header and row count separately from the raw ZIP/CSV/XLSX download's metadata hash. Raw binary ZIP/XLSX downloads are not in the archive and cannot be rehashed here. Source data-as-of dates are absent; capture time, filename labels, latest successful heartbeat and store build time are separate. The raw PIV workbook hash is unchanged across the 17 October cell-placement repair.

The FDA website policies were read on 18 October 2026. The qualified general public-domain policy does not settle source-specific exceptions or attribution; those remain on the held General Counsel list. No new licence clearance is claimed. Mechanical fixtures retain source receipts and review-pending status; SCI-124/Q-19 and the unavailable F4/F6/F7 prerequisites remain open.