Information Governance

Table of Contents


    Certifications

    As a wholly-owned subsidiary of Oxford Nanopore Technologies PLC, Metrichor Ltd. and the EPI2ME platform are accredited to the ISO/IEC 27001 standard and are audited annually by BSI. Related information may be found on the Terms, Conditions and Policies page.

    Personally Identifiable Information (PII)

    No personally identifiable information is knowingly collected or transferred during the analysis or storage of data in the EPI2ME platform. However, the platform does permit the use of free-text annotation fields and cannot verify the identifiability or otherwise of any entered values.

    Data in Transit

    All data in transit are encrypted using HTTPS and best-practice ciphers, automatically tested and reviewed periodically. Thus any data transferred are not in human readable form.

    Data at Rest

    All data stored in the Simple Storage Service (S3) object store, both temporarily for analysis and long term storage, are encrypted at rest with AES-256 using managed KMS-SSE keys with automated key rotation. Thus any data stored are not in human readable form. More information about KMS-SSE is available.

    All data stored in the relational database and its replicas, snapshots and backups are encrypted at rest. All database traffic in transit is encrypted using TLS.

    All data stored temporarily on analysis servers are encrypted at rest.

    Data Residency

    The data centres currently in use are located in Ireland, Beijing, N. Virginia and Tokyo. We are actively working on expanding worldwide local data residency and analysis.

    Data Retention

    Uploaded raw data, by default, are retained until the day after analysis completes. Analyses are automatically stopped after 30 days if not stopped manually before then. Long-term storage is opt-in and may be opted-out at any time. Metadata are held indefinitely. Users retain full control of sharing and deletion of stored data via the Data Manager.

    Data Ownership

    Raw data remain owned by the user. Metadata remains owned by Metrichor Ltd. and its parent company Oxford Nanopore Technologies PLC and may be used for purposes including but not limited to:

    1. Platform performance measurement and analysis
    2. System performance measurement and analysis
    3. Quality control
    4. User support
    5. User-facing analysis reporting

    Access Controls

    Interactive user access to the platform is by username and password with authentication managed using the Oxford Nanopore Technologies PLC Single Sign On (SSO) system.

    Programmatic access to the platform is by user-managed API key and secret pairs.

    Managed, role-based access controls permit use of various aspects of the system including but not limited to:

    1. Visibility and availability of applications/workflows
    2. Prerelease of applications/workflows
    3. Shared access to an organisation account
    4. Administrative application access by Metrichor representatives
    5. User-controlled report- and dataset sharing

    Shell-level access to servers in the EPI2ME environment is restricted to Metrichor representatives via temporary, time-based, strict access controls, with additional logging and monitoring.

    Systems

    All systems in the EPI2ME platform use best-practice, customised and monitored security group (firewall) ingress and egress rules.

    All systems in the EPI2ME platform use automatically monitored, change-controlled, role-based service access rights.

    All systems in the EPI2ME platform are built using principals of immutable infrastructure coupled with host intrusion detection (OSSEC-HIDS), advanced intrusion detection environment (AIDE), security auditing (Lynis), automated Antivirus scanning and package analysis (debsecan and others).

    Oxford Nanopore Technologies PLC and therefore Metrichor Ltd. perform an annual, rolling programme of penetration testing by accredited service providers together with appropriate remediation of any discoveries.

    Change Controls

    Changes are requested, prioritised and tracked in an internal ticket tracking system. Changes to software and systems are managed in an internal revision control system and automatic policies mandate code reviews as part of that change process. Deployment of changes to production environments is handled automatically by "continuous delivery" systems and are gated by both technical- and product management teams.