What we won't do with your data.
Celeus is built for research on confidential data, from patient records to survey responses. The design starts from what the model is never allowed to see, not from what it's convenient to send.
No data rows, ever.
Every path from your data to the AI model passes a guard that refuses data tables. The model works from a summary profile of your dataset - column names and types, summary statistics, and category names with small counts suppressed - and from the aggregate results of analyses. Summary statistics include each numeric column's minimum and maximum, and variable labels stored in your file are sent too.
Stays in Celeus
- Your uploaded file
- Data rows or data tables
The statistics are computed here, in R, never by the AI.
Sent to the AI model
- Column names, types and variable labels stored in your file
- Summary statistics, including each numeric column's minimum and maximum
- Category names, with small counts withheld
- Value shapes in text columns without listed categories, and a 1-5 uniqueness measure per column
- Aggregate results of your analyses
- Text you write: chat messages, research questions, notes and codebook descriptions
- Dataset names (by default, the name of the file you uploaded)
What the AI model does, mainly
- Suggests a test when you ask for one
- Suggests which columns are outcomes, exposures and groups when you draft a study plan
- Writes a plain-language interpretation of each run's aggregate results (on by default, and you can switch it off)
- Answers your questions in chat, where it can run exploratory analyses in R and propose analyses, filters and data transforms that apply only when you confirm them
- Drafts and edits your text, such as study context and Methods and Results
Every column the identifier scan flags is excluded from the AI by default when you upload. A column the scan does not flag is summarized like any other column, so exclude any column you know holds identifiers; you can exclude any column yourself, or include a flagged one again after review. An excluded column is left out of the profile the assistant works from. If you run an analysis on a column that is still excluded, its name and category names are replaced with neutral labels before anything about that analysis is sent to the AI. If you include a column again, the AI sees its summaries and its name, never its data rows.
Text you write is sent as you wrote it: chat messages, your research question, project and dataset notes, codebook labels and descriptions, and the names of your datasets (by default, the name of the file you uploaded). Keep identifiers out of those.
Scanned before anything else happens.
Every upload is checked against the HIPAA Safe Harbor identifier categories, by column name, by value pattern and with a free-text scan. You decide what happens to each flagged column: drop it, pseudonymize it, reduce dates to the year or shift them, cap ages over 89, or truncate ZIP codes. The result is saved as a new version of the dataset.
A workspace owner or admin can choose to store identified data instead. That takes a second factor and accepting an attestation, and it stays off unless an owner or admin turns it on.
A second factor where it counts.
You sign in with Google. On top of that, you can enroll an authenticator app or a passkey or security key as a second factor. Deleting data, projects or accounts, inviting or removing team members, changing roles, sharing a project flagged as containing identifiers, and turning on identified-data storage all require it, re-confirmed within the last few minutes.
Reproducible runs
Every analysis is seeded and runs on pinned package versions. The output is a reproducible package: the plan, the exact R script, the seed, full session info, and an append-only audit log. Re-run it on the same pinned engine and you get the same numbers - read the validation report.
The workspace owns the data. People own the actions.
On a Team plan, the workspace - not any individual - owns everything in it. Every member can see everything the lab has done, admins manage membership and billing, and the audit trail attributes every action to the person who took it. If a member leaves, their work stays with the lab, the way research data already works under a PI.
Research questions, not decisions about individual patients.
Celeus interprets statistical results for research datasets - it does not produce diagnosis or treatment recommendations for individual patients, and it isn't positioned or marketed as clinical decision support software.
More than 25 seats, or custom terms.
Enterprise runs on the same managed platform as every other plan. Contact us about more than 25 seats or custom terms.