Protecting customer data and IP is crucial to what we're building. Computational chemistry workflows handle structures, targets, and assay data that represent years of research and business-critical IP for our customers. We take no ownership over that work, and we treat protecting it as a core product responsibility.
This page describes our current security practices honestly. We welcome direct conversations with security and procurement teams at security@rowansci.com. If you're comparing deployment models, see our deployment options page.
This page is informational only and does not form part of any contract unless explicitly incorporated into a signed agreement.
User accounts are protected using modern authentication safeguards:
Rowan provides organization administrators with fine-grained access controls:
Additionally, Rowan can configure additional security features for organizations:
These controls are designed to satisfy the requirements of IT and security teams at pharmaceutical and materials-science organizations.
Customers retain full ownership of all input data, structures, sequences, and computational results. Rowan does not acquire any license or intellectual property rights through your use of the platform. We do not use customer data to train machine learning models without explicit written permission.
Rowan is not currently SOC 2 certified. We are building the internal controls and documentation to support certification, and we are prepared to prioritize undergoing a formal audit when required by a customer. Contact security@rowansci.com to discuss your requirements.
Security is integrated into our development process. We follow secure coding practices including input validation and SQL injection prevention and conduct informal threat modeling for features that touch customer data.
Rowan maintains dedicated cyber liability insurance, including:
Customer data is protected using industry-standard encryption:
We perform daily encrypted backups of our production database and retain seven days of rolling backups. Backups are accessible only to authorized personnel for operational recovery.
Credit card information never touches Rowan systems; all payment processing is handled by Stripe.
Rowan monitors job metadata to detect failures and improve the platform:
We deliberately do not monitor data that could compromise customer IP:
Access to production systems is restricted to Rowan engineering staff. At present, a small number of employees have database-level access required to operate and maintain the platform.
Rowan uses established cloud infrastructure providers for hosting and compute:
Customer data is stored in a DigitalOcean-managed database located in the United States. Enterprise deployments with alternative hosting, data residency, or VPC arrangements are available. Read more about deployment options.
The following third-party sub-processors may handle customer data:
| Sub-processor | Purpose |
|---|---|
| DigitalOcean | Primary database hosting |
| Amazon Web Services | Compute and storage |
| Modal | On-demand compute |
| Microsoft Azure | Supplementary compute |
| Stripe | Payment processing |
Organization customers may request a Data Processing Addendum (DPA) governing sub-processor obligations, breach notifications, cross-border data transfers, and data return and deletion procedures.
Data is retained until a customer requests deletion. Organization customers may request automatic data-deletion policies for time-limited retention. We support data export in XYZ, SDF, CSV, JSON, and PDB formats.
If you discover a security vulnerability in Rowan's platform, please report it to security@rowansci.com. We will acknowledge receipt within 48 hours and work to remediate confirmed vulnerabilities promptly. We ask that you give us reasonable time to investigate before public disclosure.
We do not offer bug bounties.
We recognize that security reviews are a normal part of enterprise procurement, and we want to make that process as smooth as possible. We are happy to:
Reach us at security@rowansci.com.