Data Sovereignty Statement

Last updated: 8 March 2026

1. You own your data

All research data, metadata, files, protocols, and content you create or upload to Libre Biotech remain your intellectual property. We claim no ownership, no derived rights, and no licence beyond what is necessary to operate the platform on your behalf.

Specifically:

• We will never claim intellectual property rights over your research data
• We will never use your data for purposes other than providing the service you requested
• We will never sell, license, or share your data with third parties for commercial purposes
• We will never use your data to train machine learning or AI models
• We will never mine your data for insights, analytics, or competitive intelligence

2. Full data export

You can export your data at any time, in full, in standard machine-readable formats. We will never restrict, throttle, or charge for data export.

2.1 Export formats

Data type	Export formats	Standard
Investigation metadata	ISA-JSON, ISA-Tab, CSV	ISA Framework (isatools.org)
Study and assay metadata	ISA-JSON, ISA-Tab, CSV	ISA Framework
Sample records	ISA-JSON, CSV	ISA Framework
Process and provenance	ISA-JSON, RO-Crate	ISA Framework, RO-Crate 1.1
Ontology annotations	ISA-JSON, CSV	OBO Foundry ontologies
Protocols	Structured text, ISA-JSON	ISA Protocol schema
Files	Original format (FASTQ, BAM, GFF3, etc.)	Community standards
Analysis provenance	RO-Crate, CWL	RO-Crate 1.1, CWL v1.2

2.2 No proprietary formats

We do not store data in proprietary schemas. All metadata is structured using the ISA (Investigation–Study–Assay) framework, an internationally recognised open standard. All workflow definitions use the Common Workflow Language (CWL). All provenance packaging uses RO-Crate.

If you leave Libre Biotech, your data works with any ISA-compatible tool, any CWL runner, and any RO-Crate consumer.

3. No vendor lock-in

Libre Biotech is designed to prevent vendor lock-in at every level:

Layer	How lock-in is prevented
Software	Open-source (AGPL-3.0). You can self-host the entire platform.
Data formats	ISA-JSON, ISA-Tab, RO-Crate, CWL — all open standards.
Data export	Full export available at any time, no restrictions, no fees.
APIs	Open REST API with CORS. No proprietary API lock-in.
Hosting	Runs on standard Linux/Apache/MySQL/PHP. No cloud-specific dependencies.
Workflows	CWL workflows run on any CWL-compatible engine (cwltool, Toil, Arvados, etc.).

4. Data location

All platform data is stored on a dedicated server operated by Hetzner Online GmbH in Falkenstein, Germany (European Union). Data is subject to EU data protection law (GDPR).

For institutional customers requiring data residency in a specific jurisdiction, we can discuss dedicated hosting arrangements.

5. Data deletion

You have the right to delete your data at any time:

• Individual records: Delete specific investigations, studies, processes, samples, or files through the platform interface
• Account deletion: Request full account deletion, which removes your personal data and disassociates your contributions
• Group data: Group leaders can delete group-level data

Deletion is permanent. Deleted data is removed from the live system immediately and from backups within 30 days. We may retain minimal anonymised records for audit purposes (e.g., "a record was deleted on this date") but not the data itself.

6. Platform continuity

If Libre Biotech ceases operation or materially changes its service:

1. 90-day notice: We will provide at least 90 days' written notice to all registered users via email
2. Full data export: During the notice period, full data export will remain available
3. Assisted migration: We will provide reasonable assistance to help institutional customers migrate to alternative platforms or self-hosted instances
4. Source code: The platform source code remains available under AGPL-3.0 regardless of the service's status

7. Institutional data governance

For institutional customers, we support:

• Data ownership agreements: Written confirmation that the institution owns all data created under its workspace
• Access control: Group-based permissions, role-based access, visibility controls, and embargoes
• Audit trails: Process-level provenance tracking for compliance and reproducibility
• Data classification: Visibility levels (private, group, public) to match institutional data governance requirements
• Embargo management: Time-based release controls for pre-publication data

8. Indigenous data governance

We recognise that some research data — particularly in biodiversity, environmental, and community science contexts — may relate to Indigenous knowledge, lands, or cultural heritage. We are committed to supporting the CARE Principles for Indigenous Data Governance (Collective benefit, Authority to control, Responsibility, Ethics).

We will work with Indigenous communities and institutional partners to implement appropriate governance mechanisms as these needs arise. If you are working with data that has Indigenous data governance requirements, please contact us to discuss how we can support your obligations.

9. Commitment

10. Contact

For questions about data sovereignty, institutional data governance, or to request a data ownership confirmation letter:

• Email: legal@librebiotech.org