CyteType combines local preprocessing with a hosted annotation and reporting service. This page describes the current data flow and security controls in the standard hosted service. If your institution has specific contractual, regulatory, or provider requirements, contact Nygen before uploading the data.
Security and privacy at a glance
- New reports are private by default. Report owners control explicit sharing, organization visibility, and public visibility.
- HTTPS protects data in transit with TLS. Infrastructure providers encrypt stored data at rest.
- Passwordless sign-in, API tokens, secure session cookies, and signed report-access tokens protect access to accounts and reports.
- Uploaded scientific data is not used to train or benchmark models.
- Organizations can use supported model-provider accounts under their own provider agreement.
- Report owners can delete reports from the CyteType Dashboard.
- A Data Processing Agreement is available on request for customers using CyteType under a commercial license.
Data handled in a standard CyteType run
The official Python and R clients preprocess the analysis object in the user's environment. They then submit structured summaries and two purpose-built artifacts needed for annotation, evidence generation, and interactive report tools.
Request summaries
The annotation request includes:
- Study context and report metadata supplied by the user
- Cluster labels and marker genes
- Per-cluster expression percentages across genes
- Aggregated categorical metadata when enabled
- Sampled visualization coordinates
- Client and workflow settings needed to run the job
Uploaded artifacts
The clients also create and upload:
vars.h5: the normalized expression matrix, feature metadata, and raw counts when an integer-valued count source is availableobs.duckdb: the complete cell observation metadata table and visualization coordinates
The official clients do not upload FASTQ files, BAM files, or the original AnnData or Seurat object as a single file. The CyteType artifacts nevertheless represent expression and metadata from that object, so they should be reviewed with the same care as the source analysis.
How CyteType uses scientific data
CyteType uses the submitted scientific data to run the annotation workflow, generate and host the report, support evidence lookups, and provide interactive research features requested by the user. Uploaded scientific data is not used to train or benchmark models.
CyteType also collects operational telemetry to run, secure, support, and improve the service. This includes service-health, performance, error, and product-interaction information. Diagnostic traces can include context associated with a job when it is needed to investigate a failure. Operational telemetry is separate from using uploaded datasets to train or benchmark annotation models.
Models, infrastructure, and scientific services
CyteType separates full uploaded artifacts from the focused context sent to model and scientific service providers.
Model providers
Managed model routing can use Baseten, DeepInfra, Fireworks, OpenRouter, OpenAI, and xAI. The active route can vary by workflow step, service availability, and commercial configuration.
Model prompts can include study context, marker genes, cluster-level expression percentages, metadata summaries, candidate annotations, and reasoning produced during the workflow. Interactive research tools can retrieve expression or observation values, and relevant results can then be included in a model prompt. The vars.h5 and obs.duckdb files are not sent to model providers as complete files.
Hosted infrastructure
CyteType uses Supabase for authentication and service records, Modal for application compute and job artifacts, and Cloudflare R2 for managed object transfer and upload staging. These providers operate the underlying security controls for their respective services, including encryption at rest.
Scientific and operational services
Scientific tools can query services such as PubMed and NCBI, UniProt and InterPro, and Open Targets. These services receive focused biological search terms, such as gene names, ontology terms, or citation queries, rather than uploaded artifact files.
PostHog supports product analytics and Logfire supports application observability. Account validation and network-security checks can also use dedicated email and IP services. These services receive the account, network, usage, or diagnostic information needed for their function.
Access and sharing controls
CyteType requires authentication for new annotation submissions. API tokens identify the user or organization that submits a job, and new reports are private unless the owner selects another visibility.
- Private: available to the owner and users with whom the owner explicitly shares the report
- Organization: available to members of the report's organization
- Public: available to anyone with the report link
An organization administrator can manage organization tokens and settings, but the administrator role alone does not provide access to another user's private reports. Authorized Nygen personnel may access service data when required to operate, secure, support, or troubleshoot CyteType.
How CyteType protects access
- Encrypted connections: CyteType uses HTTPS with TLS, the current standard that succeeded SSL, for data sent between clients, browsers, and the service. Database connections also require TLS.
- Encrypted storage: Database, compute, and object-storage providers encrypt stored data at rest using provider-managed controls.
- Passwordless sign-in: Dashboard users sign in with a one-time code sent to their email address.
- Revocable API access: API tokens authenticate annotation requests and can be disabled from the Dashboard.
- Secure sessions: The dashboard stores signed session credentials in secure, HTTP-only cookies. Browsers do not expose these cookies to page scripts.
- Scoped report access: After checking ownership and visibility, the server issues a signed, time-limited JWT for a specific report. The token cannot be reused for a different report.
- Service controls: Server-side authorization checks, database access policies, managed secrets, rate limiting, and operational monitoring provide additional layers of protection.
Use your organization's model provider
Organizations can configure supported model-provider accounts, including OpenAI API-compatible services and AWS Bedrock. This lets the organization apply its own provider agreement, account controls, and model configuration.
A ChatGPT Enterprise workspace is separate from OpenAI API access. To use an organization's OpenAI account with CyteType, the organization needs API access and credentials that are valid for the selected API service.
Customer-supplied provider credentials and the relevant scientific prompts pass through the CyteType service so that it can orchestrate the workflow. Using a customer-owned provider does not bypass CyteType's backend, artifact upload, or report hosting. Retention and training controls at the model provider remain governed by the organization's provider agreement and configuration.
Plan for sensitive or regulated work
Before using confidential human data:
- Work from a reviewed copy of the AnnData or Seurat object.
- Remove direct identifiers and observation columns that are not needed for annotation or report exploration.
- Keep study context and report metadata free of names, record numbers, or other identifying text.
- Confirm the proposed data transfer with the responsible institutional security, ethics, or data-protection team.
- Contact Nygen before use if the project requires a specific provider, data-processing agreement, deployment boundary, or access procedure.
The current official clients do not provide a summary-only mode that disables artifact upload. Setting aggregate_metadata=False removes aggregated metadata from the request summary, but it does not remove the observation table from obs.duckdb. Setting require_artifacts=False allows a run to continue when an artifact fails; it does not prevent successful artifacts from being uploaded.
❗️ Important: CyteType does not detect or remove direct identifiers or protected health information. Complete the required institutional review before uploading confidential human data.
Deleting reports
Report owners can delete reports through the CyteType Dashboard. Deletion removes the report from normal dashboard views, revokes standard report access, and removes explicit user shares. Archiving is different: it only hides a report from the default dashboard view and can be reversed.
If an institution requires a specific deletion procedure, confirm that requirement with Nygen before using the service.
Complete your security review
Customers using CyteType under a commercial license can request a Data Processing Agreement. Nygen can also respond to security questionnaires and discuss customer-specific model-provider, access, and deployment requirements. Contact contact@nygen.io before uploading data that is subject to a formal institutional review.
Learn more
