Compliance

Last updated: 15 October 2026

This page summarises how the Scholaris Labs group meets its legal, data protection, security and AI governance obligations for SciNodes. It is written for researchers, institutions, procurement teams and data protection officers. The binding commitments are in the documents linked below.

1. Legal documents

2. Corporate information

3. Data protection

Frameworks. We comply with:

• the UK GDPR and the Data Protection Act 2018;
• the EU GDPR;
• India's Digital Personal Data Protection Act, 2023, and the DPDP Rules;
• the CCPA/CPRA (California), to the extent it applies.

Roles.

• For individual accounts, we act as controller (Data Fiduciary in India).
• For institutional deployments, we act as processor under our DPA.

Data residency.

• Primary hosting: the EU, in AWS eu-north-1 (Stockholm, Sweden).
• India: the document database (MongoDB Atlas) is in AWS ap-south-1 (Mumbai).
• United States: authentication, front-end delivery, payments and AI model inference use providers in the United States, among other locations.

Transfers. Data leaving the UK or EEA is protected by adequacy decisions (including the EU-US Data Privacy Framework where the recipient is certified), the EU Standard Contractual Clauses and the UK Addendum. Transfers out of India comply with Section 16 of the DPDP Act.

Individual rights. Users can view, correct, export and delete their data in the product, or by writing to privacy@scinodes.com. Users in India can also contact our Grievance Officer at grievance@scinodes.com.

Children. Users must be 13 or older. Users under 18 need parental consent, and in India that consent must be verifiable.

No sale of data. We do not sell personal data, use it for targeted advertising, or use advertising or third-party analytics trackers.

4. Security

The full set of measures is in Annex II of the DPA. In summary:

• Encryption: TLS for all data in transit; AES-256 at rest for databases, file storage and backups.
• Identity and access control:
  • Firebase Authentication for users, with HTTP-only session cookies;
  • role-based, least-privilege access for staff, with multi-factor authentication on administrative and cloud accounts.
• Tenant isolation: every request is authorised against project ownership and membership (owner, editor or viewer).
• Resilience: managed, replicated databases and automated off-provider backups.
• Incident response: a documented process. We notify:
  • institutional customers within 48 hours;
  • regulators and affected users as the law requires, including the ICO and EU supervisory authorities within 72 hours where a notification is required, and the Data Protection Board of India;
  • CERT-In within 6 hours of noticing a reportable cyber security incident.
• Certifications: we do not currently hold SOC 2 or ISO/IEC 27001 certification. Security documentation and completed security questionnaires are available to institutional customers on request.

Responsible disclosure. Please report security vulnerabilities to security@scinodes.com. We will acknowledge your report within 3 working days. We will not take legal action against good-faith research that follows this policy, which means it:

• avoids accessing other users' data;
• avoids service disruption;
• gives us reasonable time to fix the issue before disclosure.

5. AI governance

• Transparency. The AI features are clearly identified in the product, so users always know when they are interacting with an AI system or reading AI-generated content. This meets the transparency obligations in Article 50 of the EU AI Act.
• Models. AI features use third-party models (Anthropic, OpenAI, Google Gemini, Amazon Bedrock) and our own models. The providers are listed in the Sub-processor List.
• No training by providers. Our model providers are contractually barred from training on customer data.
• Our own model improvement. We use only de-identified, aggregated data, and users can opt out. In India it is opt-in. Content from users under 18 is never used.
• Risk classification. SciNodes is a research-assistance tool. It is not designed for any of the high-risk uses listed in Annex III of the EU AI Act, such as education admissions or assessment, employment, or credit decisions, and the Acceptable Use Policy prohibits using it for such decisions.
• Accuracy safeguards. The Terms and the product tell users to check AI outputs against primary sources. The AI research assistant links its claims to the publications in the user's corpus where possible.
• Research integrity. The Acceptable Use Policy prohibits fabricating data or citations and requires users to follow their institution's AI disclosure policies.

6. Copyright and scholarly content

• Bibliographic data comes from open sources, including OpenAlex (CC0), Crossref, ROR and DOI agencies, and is used under their terms.
• Full texts are fetched only from openly accessible locations, in line with robots directives. Users are responsible for their rights in the PDFs they upload.
• Copyright complaints: send them to legal@scinodes.com. The procedure is in Section 10.4 of the Terms of Use. We remove infringing material and suspend repeat infringers.

7. India-specific compliance

• IT Act, 2000 and the Intermediary Guidelines, 2021: our published terms of use and privacy policy, a Grievance Officer, complaint acknowledgement within 24 hours, and resolution within the prescribed period.
• CERT-In Directions (April 2022):
  • reportable incidents are reported to CERT-In within 6 hours;
  • ICT system logs are kept for a rolling 180 days within India;
  • our systems are synchronised to an NTP time source as the Directions require.
• Consumer Protection (E-Commerce) Rules, 2020: we disclose seller details, prices, cancellation and refund terms, and grievance contacts.
• Payments: in India, payments are processed by Razorpay, a payment aggregator authorised by the RBI. Recurring charges follow RBI e-mandate rules, including notifying you before each debit.

8. Other commitments

• Accessibility: we aim for WCAG 2.2 AA. See the Accessibility Statement.
• Sanctions and export controls: we do not provide the Service to sanctioned persons or to comprehensively sanctioned jurisdictions.
• Anti-bribery: we comply with the UK Bribery Act 2010 and India's Prevention of Corruption Act, 1988.
• Modern slavery: we do not tolerate modern slavery or human trafficking in our business or supply chain. Scholaris Labs UK Limited is below the turnover threshold for a statutory statement under section 54 of the Modern Slavery Act 2015.

9. Contact