Vesta accounts are authenticated through Auth0, an industry-standard OAuth 2.0 / OpenID Connect provider, using PKCE — the same secure flow used by modern desktop apps. Your session is a signed JSON Web Token, verified by BioMedware's server; an invalid, expired, or tampered token prompts you to sign in again.

Vesta checks your account status once per app launch, not on a recurring background schedule. If our servers are briefly unreachable, your last confirmed status stays valid for up to a 7-day grace period before you'll need to reconnect. Session tokens are stored locally, encrypted with Windows' built-in data protection (DPAPI), and refreshed automatically. Seat limits for your license are managed by BioMedware. Contact support@biomedware.com for details on your plan.

Existing Keygen license holders are migrated to an Auth0 account automatically at first sign-in, using just your email — no license key needed.

All data you import into Vesta is processed and analyzed locally on your machine — Vesta never transmits your raw data values, except through two optional, explicit features: the AI Advisor's Data Visibility toggle (shares a data sample with our LLM provider) and Cloud Projects (saving/sharing a project to the cloud). Both are off by default and require your own action to enable; see their sections below for exactly what each shares. Otherwise, your project files (.gmd) and exports stay on your local drive.

Vesta stores application and project data locally using isolated, JSON-based storage with atomic file writes to prevent corruption, and keeps different data sources in separate cache directories. Project files aren't encrypted by Vesta itself — protecting data at rest depends on your machine's own security (disk encryption, access controls), which we recommend configuring if you work with sensitive data.

Cloud Projects (part of Vesta Online) lets you optionally save a project to BioMedware-hosted cloud storage and share it with teammates, instead of keeping it local-only. Nothing here applies unless you choose to save or share a project.

Saving uploads your project file — including your actual data, not just metadata — over an encrypted connection, using short-lived (30-minute), single-use transfer links; our servers broker the transfer but don't read the file's contents.

Only you, and anyone you've explicitly shared a project with by email, can access it — you choose an access level per share (view, edit, or duplicate), and projects are never made accessible via a public link. Prior versions are retained per your plan's storage and history limits; contact support@biomedware.com for details.

Because your actual data is stored on our servers when you use this feature, it's the primary consideration for institutions with strict data residency, HIPAA, or governance requirements — evaluate it as you would any cloud storage vendor. Vesta's core desktop analysis doesn't require Cloud Projects; keep projects local if your policies require it.

Vesta Online runs on Amazon Web Services in a segregated, multi-account environment in the United States, locked to a single US region — your project data isn't copied elsewhere. The accounts holding the audit trail and backups are deliberately separated from the account running the application, with different trust boundaries, so a compromise of the application would not reach the record of what happened or the backups.

Your project files are held in private cloud storage that's encrypted at rest and can't be made publicly accessible — files are served only through signed links that expire, never through guessable URLs. Everything travels over an encrypted HTTPS connection (TLS 1.2 or higher), and a web application firewall filters common attack traffic at the edge before it reaches the application.

Access is evaluated for your account on every request. Sign-in is handled by Auth0, a dedicated identity provider — we never see or store your password. A project is reachable only by you and the people you've shared it with by email, at the access level you chose; there are no public project links. Another customer cannot reach your data, even with a valid account of their own.

Every saved version of your project is kept, and both the project store and the account database are covered by automated backups — with 35 days of point-in-time recovery on the database, and backup copies held in a separate account that the production system cannot delete.

The platform follows a least-privilege design: each component holds only the permissions it needs, and credentials are held in a managed secrets vault, never in application code. Organization-level policy guardrails are enforced by AWS itself at a level above the account — they constrain BioMedware's own administrators, not only our users. Automated intrusion detection, vulnerability scanning, and configuration-drift detection run continuously across the environment.

Vesta includes an optional AI Advisor for questions and guidance on spatial data analysis, visualization, and exploration. Requests travel over an encrypted HTTPS connection to BioMedware's server, which forwards them to Amazon Bedrock within BioMedware's own AWS environment.

Advisor sign-in uses Auth0 (OAuth 2.0/OIDC with PKCE); session tokens are JWTs with automatic refresh and secure local storage. BioMedware manages the API keys server-side — they're never stored on your machine. Your Advisor conversations are not used to train AI models.

What the Advisor sends

Using the Advisor at all is optional — none of this applies unless you open it. Within the Advisor, a separate opt-in called Data Visibility controls whether actual data values are shared on top of the metadata sent by default; the two toggles are independent.

By default (Data Visibility off), each request includes:

• Dataset names and observation/object counts
• Variable names (numeric and categorical)
• Grid details (name, dimensions, cell size)
• Prediction model names
• Open workspace and visualization names
• Your Windows username (for session identification)

With Data Visibility on, requests additionally include summary statistics or sample rows from your data, so the Advisor can give more specific answers. This is off by default, requires its own consent, and can be turned off anytime.

If your dataset or variable names contain PHI, PII, or proprietary terms, that information is sent to the model provider as part of the metadata above, regardless of the Data Visibility setting.

Recommendations for sensitive environments

• Use generic or coded names instead of sensitive dataset, variable, or column names (e.g., "var_01").
• Leave Data Visibility off for sensitive or regulated data.
• Your Windows username is sent with every request — consider this if it's identifying.
• The Advisor is entirely optional; Vesta works fully offline without it.

Vesta uses third-party libraries and services for maps, charts, and the optional AI Advisor. Map tiles come from MapTiler, rendered via the ThinkGeo library — these are received and displayed only; Vesta never sends your data or feedback to either.

Tile requests do reveal the general area you're viewing, since the map service needs to know which tiles to send, though no attribute data or dataset metadata is included. If you work with sensitive location data, consider using ID proxies or anonymized geographic identifiers. Hovering over a map object shows metadata locally only — it's never sent externally.

Charts are rendered locally using SciChart, with no external communication. The optional AI Advisor uses Amazon Bedrock, reached through BioMedware's server within our own AWS environment — see the LLM Advisor section above for what is and isn't sent.

Licensed users are prompted to update Vesta at launch. Updates are checked for and delivered over an encrypted HTTPS connection, and only the information needed to check for and download the new version is transmitted — no user data or analysis files.

If your environment needs advance notice of updates, or operates behind a restrictive firewall, contact support@biomedware.com.

Vesta Team and Enterprise plans support multiple seats for labs and shared-use settings — each person signs in with their own account, and a team admin manages seats centrally.

On the desktop app, your projects and session data live under your own Windows user profile, following standard OS-level separation between users. We recommend each person on a shared computer also use their own Windows account, so files and cached credentials aren't accessible to others using the same machine.

Vesta Online — including Cloud Projects — enforces account-level data isolation and logs access at the server, since that data is stored and accessed centrally rather than on each person's machine.

For specific access-control or seat-management needs, contact sales@biomedware.com.

Is Vesta HIPAA-compliant?

Vesta's desktop app processes data locally and doesn't transmit raw values to external servers. Two optional features are the exception: the AI Advisor sends dataset metadata (and, if you enable Data Visibility, summary statistics or sample rows) to Amazon Bedrock within our AWS environment — a sub-processor to account for in any BAA analysis — and Cloud Projects stores your actual data on our AWS-hosted servers when used, making it the primary HIPAA consideration if enabled. For locally-processed data, HIPAA compliance responsibility rests with your institution's own security infrastructure — disk encryption, access controls, and network policy.

We want to be precise here: Vesta Online is architected to healthcare-grade practices, with the controls described on this page configured and verifiable. However, we do not hold HIPAA certification, a SOC 2 report, or ISO 27001 — no third-party assessment of this kind has been performed. "Healthcare-grade" describes how the system is built; it is not an external attestation, and we will not present it as one. If your procurement or ethics review needs an assessment we don't yet have, please tell us — it's useful for us to know which ones our customers actually require.

Does Vesta collect telemetry or usage data?

No. Vesta's only outbound connections are for account sign-in (Auth0), map tiles (MapTiler), update checks, and the optional AI Advisor and Cloud Projects — the last two reaching BioMedware's server. Customers not yet migrated from Keygen may see a one-time legacy connection during migration.

What should I do if I work with sensitive or individually identifiable data?

We recommend the following best practices:

• Use generic or coded names instead of sensitive dataset, variable, or column names, especially if you plan to use the AI Advisor.
• Enable full-disk encryption and restrict access to your Vesta installation.
• Use ID proxies or anonymized location identifiers for individually identifiable geographic data.
• Skip Cloud Projects if your policy prohibits storing data outside your own infrastructure — projects stay local by default.
• Vesta can run largely offline (a 7-day grace period after sign-in) if your policy restricts network connections; the AI Advisor and Cloud Projects are both optional.
• Confirm with your IRB or data use agreement that local analysis — and any use of Cloud Projects — is within scope.

What outbound network connections does Vesta make?

Can I run Vesta in an air-gapped or restricted network environment?

Mostly. Core analysis works entirely offline. First sign-in needs internet, but afterward you get a 7-day offline grace period before reconnecting is required. Maps need network access for tiles, and Cloud Projects needs a connection when used — everything else (import, analysis, charting, project management) works with no connection. If your environment can never connect, even briefly, contact support@biomedware.com to discuss options.

What about GDPR and international data transfers?

The platform runs in the United States (AWS, US-East region). If you use Vesta from the European Economic Area, the United Kingdom, or Switzerland, your personal data is transferred to the United States. Our providers support those transfers under recognized mechanisms: AWS, Auth0, and Stripe each participate in the EU–U.S. Data Privacy Framework and offer Standard Contractual Clauses in their data-processing terms.

The personal data we hold is limited to your account identity, authentication records, subscription status, and any research data you choose to upload — the last of which stays under your control and can be deleted by you at any time. If your institution requires EU data residency, our infrastructure is fully defined as code, so a European deployment is a scoping question rather than a rebuild — please raise it with us if it's a requirement.

Vesta validates imported files against expected formats before processing, and uses custom, strongly-typed converters to safely deserialize complex project data, such as time series and numeric arrays. Error messages are informative without exposing sensitive system details, and the app is designed to degrade gracefully when a component fails.

Our test suites use synthetic and sample datasets, never real customer data. Sensitive configuration values — API keys, database credentials, and similar secrets — are never committed to source control; they're held in a managed secrets vault and supplied at deploy time, and development, testing, and production run in separate environments with separate credentials.