Where data sits and who processes it
This page lists the tools Oncera uses, where they run and the status of the contracts for them. Every statement here without a marker is documented.
BEAM, and the language model that drives it, run in house
The chain that designs a binder stands on a GPU workstation at BioM in Planegg-Martinsried. A locally running language model acts as the harness and drives the specialist models: Boltz 2 pre-sorts, BEAM R2 scores the energetics, and the improved binder goes into the next round. No step calls a cloud interface. For a co-development project the same chain is meant to run at the partner, so that sequences and structures stay there.
Oncera’s house, or the partner’s
GPU workstation · at BioM, not run as a network service
VHH sequence 1
starting binder
Language-model harness
Qwen 3 80B, local; drives our own models
Boltz 2
open source, local, pre-sorts
BEAM R2
our own model, scores the energetics
VHH sequence 2
optimised binder
no cloud interface in the chain
What applies to a co-development project
Compute where the data is
BEAM runs on a local GPU workstation and is not run as a network service. For a co-development project it is meant to be installed at the partner. How data is deleted after the project is set out in the collaboration agreement.
Tools with their location
The table below names the tools through which partner or portal data pass, each with its purpose, location and contract status. The privacy notice names the same recipients, locations and contracts, and every further processor besides.
Partner data and model training
Whether and how results from a co-development project feed into training the models is agreed with each partner in advance. Without such an agreement we train on our own data only.
Tools that touch partner or portal data
As of 15 Oct 2026. The table names the tools through which data of visitors, portal users or partners pass. DPA stands for the data processing agreement under Art. 28 GDPR, in German AVV.
| Tool | Purpose | Location | DPA |
|---|---|---|---|
| Vercel | Hosting for this website and the access-restricted research portal | Vercel Inc., USA. Server functions in the Frankfurt am Main region, next to the database; requests arrive at the Vercel location nearest the visitor | Part of the terms of service, in force since 5 May 2026 with the Pro plan. Version of 31 Mar 2026, with standard contractual clauses |
| Supabase | Database | Supabase Pte. Ltd., Singapore. Database in the Frankfurt am Main data centre | Part of the terms of service, in force since 8 Jul 2025. Version of 1 Aug 2026, with standard contractual clauses |
| Google Workspace | Email and calendar | Google Ireland Ltd. (contracting entity), data region Europe | Part of the Workspace agreement (Cloud Data Processing Addendum), with standard contractual clauses |
| BEAM | Binder design and scoring | Oncera’s own local GPU workstation, not run as a network service. Located at BioM in Planegg-Martinsried | Not applicable, our own hardware, not a service provider |
Analytics (Umami) and error reports (Sentry) are built in. They run only with consent and are currently switched off.
The privacy notice lists every processor, including the tools for planning, booking and writing that hold no partner or patient data. Read the privacy notice
What IT and legal will ask
IT
- Traffic only over encrypted HTTPS, with HSTS
- Security headers against framing by other sites and against MIME sniffing
- Passwords are stored only as bcrypt hashes
- The research portal only by invitation and login, with access separated by role
- Fonts come from our own server, with no request to Google Fonts
Legal
- The privacy notice names the processing, the recipients and the same contract status as the table above.
- Analytics and error reports only with consent, which can be withdrawn at any time
- A confidentiality agreement before the first data exchange
- Retention and deletion periods: in the collaboration agreement for partner data, with incorporation for the research portal
Where the evidence stands
Anything marked as available can be shown on request.
Privacy notice
Available
In line with this page: DPAs, two-factor sign-in and logging are described there. The legal review is still to come.
Database in the EU
Available
Supabase, data centre in Frankfurt am Main.
Application in the EU
Available
Vercel runs the server functions in its Frankfurt am Main region, next to the database. Requests are received and the sign-in checked at the Vercel location nearest the visitor; where Vercel stores its logs is not documented. Vercel Inc. remains a US company, so the DPA in the next row is still needed.
DPAs with our service providers
Available
Vercel, Supabase and Notion through their terms of service, with standard contractual clauses, Google through the Workspace agreement. Not needed for AI assistants, because no portal, partner or patient data is entered there.
DPA for partners
Not in place
There is no template of our own. Processing is settled in the collaboration agreement.
ISO/IEC 27001 (information security)
Open
In preparation since October 2026: policies, a register of systems, an incident process, access rights. The certification audit follows once the GmbH is founded, because the certificate belongs to the legal entity. There is no certificate yet. As of 15 Oct 2026.
ISO/IEC 42001 (AI management system)
Open
In preparation alongside ISO/IEC 27001: a register of AI systems, a risk assessment, rules for training, release and review of the models. The standard describes a management system for AI and supports the preparation for the EU AI Act without replacing the classification under it. Certification after the GmbH is founded. As of 15 Oct 2026.
Penetration test
Not in place
Not yet carried out. An external test is on the roadmap after incorporation, before the first exchange of partner data.
EU AI Act
Open
BEAM designs binders for research and is not a medical device. The AI Act excludes systems developed solely for scientific research and development from its scope (Art. 2(6)). The exemption ends as soon as a model is made available beyond research. We assess the classification before that step.
Research use only
Oncera is a research project. Binders designed by BEAM are computational predictions until they have been tested in a laboratory. The content of this site and all results are not for diagnostic or therapeutic use.