Confidentiality and security are crucial in chemistry, and we take protecting our users' data seriously.
This page describes our current security practices. It is informational only and does not form part of any contract unless explicitly incorporated into a signed agreement.
We protect user accounts using modern authentication safeguards:
Rowan provides organization-level controls to help teams manage access to sensitive data and projects:
Organization accounts also support IP-based access restrictions, allowing administrators to restrict access to approved IP addresses or ranges.
Rowan is not currently certified under formal security frameworks such as SOC 2. We are actively building our internal controls and processes to align with industry best practices and intend to pursue SOC 2 certification as our organization and systems mature.
Formal penetration testing is not yet part of our security program; we plan to incorporate it alongside our SOC 2 efforts.
Until then, we continue to invest in security, monitoring, and access controls, and we welcome customer feedback.
Rowan maintains dedicated cyber liability insurance to support incident response and risk management.
Our current coverage includes:
This coverage is designed to support rapid recovery and customer protection in the event of a confirmed security incident.
Customer data is protected using industry-standard encryption technologies:
We perform daily encrypted backups of our production database and retain seven days of rolling backups. Backups are stored securely and are accessible only to authorized personnel for operational recovery purposes.
Credit card information never touches Rowan systems; instead, we use Stripe as our payments processor.
Rowan monitors job metadata, both through automated dashboards and manually, to help us detect failures and improve our platform. Specifically, we monitor:
We do not monitor data that might compromise customer IP. Specifically:
Access to production systems is limited to Rowan staff. At present, a small number of employees have database-level access required to operate and maintain the platform.
In the event of a confirmed breach, affected customers will be notified in accordance with applicable law and contractual obligations.
Rowan uses third-party cloud infrastructure providers for hosting and compute, including:
Customer data is typically stored in a DigitalOcean-hosted database in the United States.
Enterprise deployments with alternative hosting or database arrangements are available.
Organization customers may execute a Data Processing Addendum (DPA), which governs:
By default, data is retained unless a customer requests deletion. Operational backups are retained separately for disaster recovery.
We offer configurable data auto-deletion policies for organization customers who prefer time-limited retention.
Customers maintain full control of their intellectual property. Uploading a structure to Rowan doesn't give us any claim to your IP, just like making a presentation in PowerPoint doesn't give Microsoft any claim to your IP. We do not use customer data to train machine learning models without explicit permission.
We support export of computational data in formats including XYZ, SDF, CSV, JSON, and PDB.
Security is an ongoing commitment. If you have specific requirements or ideas for improvement, please reach out at contact@rowansci.com.