You're offline. Some features may be limited

Your DNA Data is Safe

Security

Genetic data is among the most sensitive information you can share. We engineered MYDNATLAS from the ground up with security as a core requirement, not an afterthought.

Last updated: May 13, 2026

Security Overview

MYDNATLAS employs multiple layers of security to protect your genetic data at every stage, from the moment you upload a DNA file through to the storage of your analysis results. We follow industry best practices and comply with GDPR, the Australian Privacy Act 1988, and the Australian Privacy Principles (APPs).

Data Encryption

  • •All data encrypted in transit using TLS 1.3 with modern cipher suites
  • •Data at rest encrypted with AES-256 across all database tables and storage buckets
  • •API keys and secrets stored in encrypted vaults, never in source code
  • •End-to-end HTTPS enforcement with HSTS preloading

Authentication & Access

  • •Secure email/password authentication with bcrypt hashing and salting
  • •Optional multi-factor authentication (MFA) via TOTP authenticator apps
  • •Backup recovery codes generated at MFA enrollment
  • •Session tokens with automatic expiry and refresh rotation
  • •Rate limiting on all authentication endpoints to prevent brute force attacks

Row Level Security

  • •Every database query is scoped to the authenticated user via Supabase RLS policies
  • •No user can access, modify, or view another user's data through any API endpoint
  • •Admin access requires separate elevated privileges with audit logging
  • •All RLS policies are tested and verified across 226+ database tables

DNA File Handling

  • •Raw DNA files (23andMe, AncestryDNA, etc.) are deleted immediately after G25 conversion
  • •Temporary processing files are purged within 7 days with secure deletion
  • •Only G25 coordinates (25 numerical values) are retained, not your raw genotype data
  • •You can permanently delete all your data at any time from account settings

Infrastructure

  • •Hosted on Supabase (backed by AWS) with SOC 2 Type II compliance
  • •Database and file storage are hosted by Supabase on AWS in Singapore (ap-southeast-1). Your data is stored outside Australia; see our Privacy Policy for what that means for you.
  • •Automatic daily backups with point-in-time recovery
  • •DDoS protection via Cloudflare with Web Application Firewall (WAF)
  • •Zero-downtime deployments with health monitoring and auto-recovery

No Third-Party DNA Sharing

  • •Your genetic data is never sold, shared, or disclosed to any third party
  • •We do not use your DNA data for research, advertising, or profiling
  • •Analytics are limited to anonymised usage patterns, never genetic information
  • •No law enforcement access without valid legal process and user notification where permitted

Regular Security Audits

  • •Automated vulnerability scanning on every deployment
  • •Dependency auditing for known CVEs across all packages
  • •Code review required for all changes touching authentication or data access
  • •Periodic manual penetration testing of API endpoints and edge functions

Vulnerability Reporting

If you discover a security vulnerability in MYDNATLAS, we encourage responsible disclosure. Please report it to:

security@mydnatlas.com

We ask that you give us reasonable time to investigate and resolve the issue before public disclosure. We will acknowledge receipt within 24 hours and provide a timeline for remediation. We do not pursue legal action against researchers who report vulnerabilities in good faith.

Security Questions?

For general security enquiries, contact security@mydnatlas.com. For privacy-related questions, see our Privacy Policy.