Thanks, Elaine, for the fast and very thorough reply! I appreciate it and will pass it on to our security folks.

Thanks,

Brian

 

 

 

EXT - meng@cgl.ucsf.edu

Hi Brian,
We don't have a document on the website but yes, some of the ChimeraX tools do use web services and this is clearly documented in their individual help pages. There are also a few other situations in which ChimeraX will contact our website, but they can be turned off. In more detail, here is a semitechnical description of what information would be shared if you used the ChimeraX software:

=-=-=-=
All the files you create are yours and simply reside on your own system. We would have no knowledge of that.

When you download the program, we record the IP address of the download. You don't need to be on the internet to actually use the program, but It is definitely more convenient to have internet connectivity, for fetching data from databases (protein data bank, EM data bank, UniProt, etc.) and using any tools that rely on web services (multiple sequence alignment, Modeller comparative modeling, etc.). You would also need internet connectivity to register to get rid of the "registration reminder" that will start popping up after a certain number of uses. Of course we would get any information you choose to share when registering.

However, network connectivity is not required to run the program. One can even keep using it without ever registering. I'm told that the only autonomous (non-user-initiated) communications via network are:

(1) to check with the ChimeraX toolshed at our own website for the existence of newer versions of ChimeraX and any third-party ChimeraX plugin bundles the user has installed. However, if network is not available it will not do the checks. Also, there is an option in the user preferences dialog to make the frequency of checking "never."
<https://rbvi.ucsf.edu/chimerax/docs/user/preferences.html>
<https://rbvi.ucsf.edu/chimerax/docs/user/preferences.html#toolshed>

(2) to look up the connectivity (bonding pattern) of any nonstandard residues encountered when opening an mmCIF file. However, if network is not available the connectivity will be guessed.

A little more detail on using web services: if the user runs ChimeraX tools that depend on web services, that will send any data needed for that calculation over the network, e.g. the sequences will be sent to the web server running the multiple sequence alignment program. One of the services (AlphaFold Predict) will send data to Google Colab, and using it requires that user to sign in to Google first.

Here is a list of web services potentially used by ChimeraX, depending on what tools/features are invoked by the user:
<https://rbvi.ucsf.edu/chimerax/docs/webservices.html>
=-=-=-=

I hope this clarifies the situation. If you do want to pursue a commercial license, please see this page for information and a link to a webform to fill out.
<https://www.rbvi.ucsf.edu/chimera/commercial_license.html>

Thanks for your interest,
Elaine
-----
Elaine C. Meng, Ph.D.
UCSF Chimera(X) team
Resource for Biocomputing, Visualization, and Informatics
Department of Pharmaceutical Chemistry
University of California, San Francisco

> On Aug 23, 2024, at 7:23 AM, Frumolt, Brian via ChimeraX-users <chimerax-users@cgl.ucsf.edu> wrote:
>
> Hi,
> We are looking at ChimeraX for commercial use. I was looking on the site for information related to data use and privacy policies. I understand the app runs locally, but was wondering whether it leverages any web services, or passes any data outside the local installation? We have strict data handling policies in place for our clients, so would need to be aware. If there is a policy document I missed, that would be ideal.
>
> Thanks!
> Brian