Security and accessibility

Where it runs

Sequality runs in the customer's own AWS account. It is deployed from Pulumi code, and nothing is changed by hand in the console. OneGlobe LLC hosts no part of it.

Production deployment: designed for AWS GovCloud (US) inside a customer's FedRAMP High boundary; not yet deployed there. Sequality holds no FedRAMP authorization of its own. The production stack is defined and tested in code, and has never been deployed end to end.

Network

• The model endpoints, rule engines and pipeline have no ingress from the internet.
• Users reach the product through the authenticated user interface and the JWT-authorized API: Amazon API Gateway, a VPC link, and an internal load balancer.
• The pipeline tier has no default route. It reaches AWS services through VPC interface endpoints and an S3 gateway endpoint.
• The user interface sits behind an ingress allowlist and AWS WAF with AWS managed rule groups.
• Amazon OpenSearch Service runs inside the VPC, requires HTTPS with TLS 1.2 at least, and encrypts data at rest and between nodes.

Language models

• Amazon Bedrock is the only language-model path. Every call goes through one gateway and a VPC endpoint, and only models on the deployment's allowlist can be called. The IAM permissions name each allowed model.
• Amazon Nova Lite is the only model on the allowlist today. No invocation logging or model customization is configured.
• For claim-feature extraction the model receives the claims, the specification text when it is short enough, and the type and length of each SEQ ID NO. It never receives sequence residues.
• Each model response is stored with a hash of the prompt, the model id and a SHA-256 of the response before it is read. Replay reuses the stored response.

Case material

Case material is treated as Controlled Unclassified Information. It stays inside the customer's boundary, is never sent to a model outside it, and is never exported with examiner identity. Examiner decisions are append-only and recorded in the application audit log.

Identity and access

• Sign-in uses Amazon Cognito, federated to the customer's identity provider by OIDC; SAML can be used instead.
• Groups in the identity provider map to roles. No group can grant the administrator role, and the user pool admits only users an administrator creates.
• Federation was run live against an Okta developer tenant on the demonstration stack on 2026-11-08.
• Roles decide what the interface offers. The API enforces every permission.
• Secrets are held in AWS Secrets Manager. Each service runs under its own least-privilege IAM role.

The sign-in and roles guide describes what each role can do.

Encryption and records

• Amazon S3 buckets are versioned, encrypted with SSE-KMS under the AWS-managed key, access-logged and closed to public access. Corpus and embedding objects carry SHA-256 checksums.
• Amazon Aurora PostgreSQL and Amazon OpenSearch Service are encrypted at rest. Customer-managed keys are not configured.
• Every search is pinned to an immutable corpus snapshot and described by a search manifest.
• The application audit log is kept in Aurora. Logs and alarms for every tier go to Amazon CloudWatch.

Exports and redaction

Every export passes through one redaction stage: search results, shortlists, case records, the search diligence PDF, mini-database FASTA files and profile HMM files. No export route bypasses it.

• A marking is applied only from a designation the customer configures. None is set by default, and none is ever invented.
• An export for a recipient inside the examining office withholds nothing. An export for a recipient outside it withholds unpublished references, case-identifying text, own-filing identifiers and counts, imported text, residues, free text and record text.
• A check runs on every rendered export. If a withheld value appears in it, the export is refused.
• Which records were found is not withheld, because an identity hit can disclose the searched sequence. Every export and the export dialog say so.
• FASTA and profile HMM files go only to recipients inside the examining office. A FASTA file has no place for a marking, so once the customer sets a designation, FASTA and profile HMM files are delivered inside a marked wrapper: a zip file with a CUI notice and a manifest. A production stack refuses to deploy without a designation.

Retention and deletion

A case's owner or a supervisor can ask for the case to be deleted. The case is hidden at once, and a purge job removes the case material within 15 minutes: the case documents, claim features, model contexts, summaries, shortlist and imported files. A closed case is deleted the same way after a grace period, 7 days by default. The purge job runs on every production stack; on other stacks it runs only when it is turned on. Each purge leaves a deletion record that holds no case material.

The searches sent from a case are kept as the examination's search record: the query, the manifest and the result set. Copies the purge cannot reach, such as database backups and the workflow history of searches, are listed in every deletion record until they expire, not hidden. Deleted saved sequences are purged too, and a deployment may set a retention period for them. Mini-databases and profile HMMs are not yet part of the purge.

Accessibility

The examiner interface is designed and tested to WCAG 2.2 AA. The tests are automated: axe scans of every main route in both color schemes, scripted keyboard tests for each workbench flow, and screenshots at 1440 px, 390 px and 200 % zoom. Manual testing with assistive technology is not claimed. PDF exports are tagged, and they make no PDF/UA-1 conformance claim. An Accessibility Conformance Report for Section 508 is planned.

This site

This site is static. It has no scripts, cookies, analytics or forms. It is served over HTTPS with a content security policy that allows only its own stylesheet and images, HTTP Strict Transport Security, and headers that refuse framing, MIME sniffing and referrers and turn off the camera, microphone and location. The privacy page says what its access logs record.