Trust centre

Certifications

We hold no security or privacy certification, and we have no independent audit report to share. No independent penetration test has been commissioned.

Encryption

In transit

In place. Every connection to bioskepsis.ai and app.bioskepsis.ai uses TLS 1.2 or newer, and both sites tell browsers to connect over HTTPS only (HTTP Strict Transport Security). Cloudflare, our content delivery network, decrypts traffic at its edge and encrypts it again before it reaches our server.

At rest

Not in place. Your account and your research, and our backups, caches and logs, are stored without encryption at rest.

AI providers

An answer is written by a large language model, so your research content has to reach one. This is where it goes and what happens to it there.

We do not train AI models on your content.

Z.AI (GLM models)

Operated by JINGSHENG HENGXING TECHNOLOGY PTE. LTD, Singapore. Z.AI serves the Basic, Plus, Pro and Team plans.

It receives your question, any text you paste, the conversation in progress, the papers being read, and the text of any file you attach. It uses them to plan searches, read the evidence, write the answer and check its citations.

Z.AI states that customer data is generally processed in Singapore. Its data processing addendum for API services states that content is processed in real time and not saved on its servers. Z.AI's published policy does not say whether it uses content sent through its API to train models, and we have no written commitment from Z.AI on that point.

Gemini on Google Cloud, in a European Union region

Operated by Google. This is the route for the Organization tier. It serves no plan today. No research content reaches Google through this route.

Sub-processors

The providers named in our privacy notice, what each does for us, and where.

Where the location reads "Confirming", we are still verifying that provider's processing region.

If you turn on browser notifications, they are delivered by your browser's own push service (Google, Mozilla or Apple, depending on your browser), outside the European Economic Area. A notification never carries your question, paper titles or any other research content.

To find papers, BioSkepsis also sends search terms written from your question to other public literature databases, including Europe PMC, OpenAlex, ClinicalTrials.gov and Crossref. None of them receives your name, email address or account details, but a search term can still show the subject you are researching.

Our privacy notice describes each of these in more detail.

Reporting a security problem

Email info@bioskepsis.ai with "Security" at the start of the subject line. We acknowledge a report within 3 working days. For a critical vulnerability we put a temporary fix in place within 3 calendar days of confirming it, and a definitive fix within 10 calendar days.

What we ask of you, what is in scope and our safe harbour are on our page about reporting a security problem. Machine-readable version: /.well-known/security.txt.

Documents for Organization customers

If your organisation is considering an Organization contract, we can share these documents on request, under a non-disclosure agreement:

• Our draft data processing agreement.
• Our answers to standard security questionnaires.
• A summary of our incident response procedure, which is still a draft.

None of these documents is published on this site. Write to info@bioskepsis.ai to ask for them. We release each one after our own review, once a non-disclosure agreement is in place.