Home › Security and data

Security and data

Where your work is kept, how it is protected, and who can see it.

Where your data is

Your account, projects, cases, inputs and results, credits and payments are stored by Amazon Web Services in London (eu-west-2).
Pages reach you through Amazon CloudFront. Its web firewall records the requests it blocks or flags (IP address and path, never cookies) for 90 days.
Payments are taken by Stripe. Card details never reach ChemEngWorks.

Encrypted in transit (HTTPS only, and TLS to the database) and at rest: the database and its backups are encrypted with keys held in AWS's key management service.
Sign-in is through Amazon Cognito: we never see your password. You can add a passkey or an authenticator app.
Sessions end after two days without use, and after two weeks at most. You can sign out everywhere from your account.
Every page and request is checked against your organisation: one organisation's work is never shown to another.

You, and the members of your organisation, as their roles allow.
Our staff sign in to a separate site with two-step verification. They can open a customer's work only through a support grant that records its reason and expires within 24 hours; in this preview environment one administrator may approve their own grant, which production does not allow.
Staff actions are recorded in an audit log, kept for two years.

Calculations run only on our servers, each in a process of its own with limits on its time and memory. The calculation code never reaches your browser.
Every result records the engine and data versions that made it (methods and validation).
Our logs record identifiers, never your inputs, results, email address or name. They are kept for 30 days.

Download everything we hold about you as one file from your account.
Delete your account from the same page: it is deleted 14 days later, and you can change your mind until then. Payment and credit records are kept for six years for accounting, without your name or email address.
Backups are encrypted and kept for up to a year; production's are also copied to AWS's Paris region, in case London is lost. Deletions are applied again to anything restored from them.
We use only the cookies sign-in needs: no analytics or advertising.