Security & Data Governance
Last updated: 12 November 2026
CohortLayer is built around a single architectural principle: the analysis goes to the data, not the data to the analysis. No individual-level genetic data is ever downloaded, moved, or processed outside its governed environment. This page explains how that works in practice.
What cohorts does CohortLayer work with?
CohortLayer works from public genetic resources and peer-reviewed literature. Analysis in managed-access cohorts is run by project, as a scientific collaboration under each cohort's own access agreement, ethics approval and governance terms. Managed-access cohorts are not open databases; they are secure research environments where individual records are protected by governance frameworks and legal agreements.
How does the analysis work without moving data?
When a project uses a managed-access cohort, the analysis runs inside that cohort's secure compute environment. We bring the query to the data, rather than the data to the query. No individual records are exported, downloaded, or transferred at any point in the process. Only aggregate statistical outputs (effect sizes, carrier counts, replication status, phenotype signals) leave the cohort environment, and only to the requesting organisation.
What data does CohortLayer receive from clients?
We receive only what is needed to define the analysis: a target, a variant, or a gene–disease hypothesis, described in general scientific terms. We do not receive, request, or store any patient data, clinical records, proprietary compound structures, or internal trial data. The hypothesis stays at the level needed to run the analysis, and no more.
How is client data protected?
All hypotheses and results are treated as confidential. We do not share them with other clients, partners, or third parties. We do not use client hypotheses to train models or derive generalised insights that could be attributed to a specific client. Results are returned only to the requesting organisation.
Cohort projects can carry registration and publication requirements set by the cohort. These are agreed with the client before a project starts.
What is the data retention policy?
We retain the minimum data necessary to deliver the service and maintain records of what was analysed and when. We do not retain raw cohort outputs beyond the delivery of results. Contact details collected via the request form are retained only as long as necessary to manage the client relationship, consistent with our Privacy notice.
How does CohortLayer handle EU/GDPR compliance?
Personal data collected through this website is limited to the request-access form and is handled under the GDPR by Hansen Consult OÜ as controller. Details are in the Privacy notice.
What are the security measures for the service itself?
The CohortLayer web service is built on server-side rendered infrastructure with no client-side data persistence. Form submissions are transmitted over HTTPS, validated server-side, and delivered via encrypted channel. We apply standard security headers (X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy). No cookies are set. No third-party advertising or tracking scripts are loaded.
Who is responsible for cohort governance?
Each cohort operates under its own governance framework, ethics approval, and data access agreements, managed by the cohort itself, not by CohortLayer. Any cohort-level project is conditional on compliance with that cohort's framework. We do not override, circumvent, or negotiate around cohort governance requirements.
What should enterprise procurement or legal teams know?
We do not process personal data on behalf of clients. Genetic data used in a cohort project is held and governed by the cohort itself. We are happy to answer specific questions from procurement, legal, or compliance teams. Contact hello@cohortlayer.com.
Contact
Security and data governance questions: hello@cohortlayer.com
Operated by Hansen Consult OÜ, Tallinn, Estonia.