Deployment options and protection of your data

Unpublished results are the most valuable thing researchers have. That is why MES.Plot comes in several variants – from "just start in the browser" to "runs only on my computer and demonstrably cannot send anything out". All variants have the same analyses and produce the same figures; they differ only in where MES.Plot runs and who could technically see the data.

Status: MES.Plot is under development. Each variant states what exists today and what is planned. Planned features are marked as such and may still change during implementation.

Contents

1. Overview: the variants at a glance
2. MES.Plot Cloud
3. MES.Plot Cloud with encryption
4. Vault projects with an additional PIN
5. MES.Plot in your own environment
6. Local application – for the very cautious
7. Which variant suits me?
8. What applies in every variant
9. Glossary

1. Overview: the variants at a glance

The variants build on each other: each level protects against everything the previous one protects against, plus something more.

What each variant protects against

2. MES.Plot Cloud

For whom: everyone who just wants to get started – students, PhD candidates, groups working on figures together.

How it works: You open MES.Plot in the browser, sign in and upload your Enrichr file. MES.Plot stores the file unchanged, calculates the figures on the server and sends them to your browser as vector graphics. Your browser creates PNG and TIFF itself.

What you get

• Nothing to install, usable on any computer with a browser.
• Save projects, reopen figures for the revision; share projects with colleagues (sharing is planned).
• MES takes care of updates and backups.

Protection

• Servers in the EU (Germany or Austria), connection always encrypted (HTTPS).
• Each project belongs to a person or organisation; other users only see it if it has been shared.
• Administrators manage accounts but cannot see projects – this is already implemented.
• Files are used only for the figures: no analysis by MES, no AI training, no disclosure.
• Without an account (demo access) data are held in memory only and deleted after 60 minutes of inactivity.

Limit: Without the encryption of the next level, files are stored in plain form in the database. Anyone who got hold of the database or a backup could read them. Level 1 encryption is therefore firmly planned for public operation.

Status: The web app with accounts, projects and database exists. Public operation on our own servers is planned.

3. MES.Plot Cloud with encryption (level 1)

For whom: automatically for all projects in the cloud – you do not have to do anything.

How it works

1. Each project gets its own key, with which its files are stored encrypted.
2. This project key is itself encrypted with a master key.
3. The master key is not on the MES.Plot server but with a separate key service. MES.Plot only requests it at the moment you open a project.
4. Backups are additionally encrypted separately.

Think of a safe-deposit box: the bank (MES.Plot server) keeps the box, but the key is kept in another building (key service).

Protects against: a stolen disk, a copied database or a lost backup – they only contain unreadable data.

Does not protect against: someone who controls the running MES.Plot server and the key service at the same time. That is what the vault with PIN is for.

Status: planned for public operation.

4. Vault projects with an additional PIN (level 2)

For whom: particularly sensitive projects – e.g. data under a non-disclosure agreement, patents, clinical collaborations. Selectable per project.

How it works

• When creating a vault project you choose a PIN. The project key is derived from the server key and your PIN. Without the PIN nobody can compute it – not even MES.
• You enter the PIN once per session. The decrypted key is then held in memory only and discarded when you sign out or after 30 minutes of inactivity.
• The PIN is stored nowhere. The key service allows only 10 failed attempts; after that the project is locked. So the PIN cannot simply be guessed even with stolen server data.

Additionally protects against: access by MES without your involvement and simultaneous theft of the MES.Plot server and the key service.

What is protected and what is not: The PIN protects your files (the actual research data). Project name and figure settings stay at level 1 – so that a forgotten PIN costs you nothing but the files.

Forgot the PIN?

• You still have your original files. After setting a new PIN, upload the files again. MES.Plot recognises them by their fingerprint (SHA-256 checksum) and all saved figures work again.
• Optionally there is an emergency copy of the key, encrypted with a recovery key that MES keeps offline (on no server). It is used only after verifying your identity; every use is logged and you are informed. If you do not want this, switch the emergency copy off – then truly nobody but you can open the files.

Sharing: Anyone who is to work on a vault project needs the PIN. Pass it on through a different channel than the invitation link (e.g. in person or by phone).

Status: planned. Outlook (level 3, long term): the figures are calculated directly in the browser; then even the running server never sees your data unencrypted.

5. MES.Plot in your own environment

For whom: institutes, core facilities, hospitals and companies whose policies require research data to stay within their own network – or that want to offer MES.Plot centrally to all staff.

How it works: Your IT runs MES.Plot itself – on a server in-house ("on premises") or in the institute's own cloud account (e.g. Azure, AWS, a university cloud). MES supplies the software but has no access to the installation and sees no data.

What you get

• The same web app as in the cloud, with accounts, projects and sharing – within your installation.
• Database of your choice: SQLite (a single file, for small installations), Microsoft SQL Server or PostgreSQL. MES.Plot supports all three today.
• Your own security rules: firewall, disk encryption, backups, access only from the institute network or via VPN – all in the hands of your IT.
• Sign-in with local accounts; sign-in via the university login (Entra ID, eduGAIN) is prepared.

Installation

• Docker package (planned, recommended): a ready-made image plus an example configuration. Start with one command, update with docker compose pull. Runs on any Linux server and in any cloud that can run containers.
• Classic (possible today): MES.Plot is an ASP.NET Core application (.NET 10) and runs on Linux and Windows, e.g. behind IIS, nginx or Apache. On first start a setup page guides you through choosing the database and creating the first administrator.

What your IT should consider

• Run MES.Plot behind HTTPS (own certificate or the institute's).
• Back up the App_Data folder: it contains settings, the keys for the sign-in cookies and – with SQLite – the database.
• MES.Plot needs no outgoing connections. You can block them completely in the firewall.

Status: can be installed manually today. Docker package, university sign-in and a licence model for customer installations are planned.

6. Local application – for the very cautious

For whom: everyone who wants to be sure that their data never leave their computer – not even encrypted, not even to MES. Typical cases: theses with confidential data, industry collaborations, working while travelling without a network, or simply peace of mind.

How it works: MES.Plot runs as a Docker container on your own computer (Windows, macOS or Linux). You open it in the browser at http://localhost:8080. The browser talks only to your own computer; projects are stored in a folder on your computer.

"Never phones home" – and how we ensure it

MES.Plot sends no data out: no usage statistics, no crash reports, no update check, no fonts or scripts from the internet. Because you should not simply have to take our word for it, this is secured technically in three ways:

1. Isolated network. The MES.Plot container is attached to a Docker network without any outside connection. In front of it sits a small standard web server (nginx) that only forwards the connection from your browser to MES.Plot. Even if MES.Plot tried – there is technically no route to the internet. This is openly readable in the supplied docker-compose.yml file.
2. Browser lock. MES.Plot sends your browser a security rule (Content Security Policy) that forbids the MES.Plot page any connection to other servers. The browser enforces it.
3. Check for every release. Before a version is published, an automatic test starts MES.Plot without any network, loads a file, calculates all analyses and exports them. If anything needs the internet, the version is not published.

Check it yourself

You do not have to trust us – you can verify it:

• Cut the network: switch off Wi-Fi or unplug the network cable. MES.Plot keeps working completely.
• Try to get out from the container: a command in the guide tries to reach any internet address from inside the MES.Plot container – it fails.
• Watch: with a firewall such as Little Snitch (macOS), GlassWire (Windows) or tcpdump (Linux) you can see that no outgoing connection is made.
• Check the contents: each image comes with a list of all its components (SBOM) and a signature with which you can verify that you downloaded exactly the image published by MES.

What you need

• Docker Desktop (Windows, macOS) or Docker (Linux). On Windows, Docker sets up WSL2 the first time and asks for a restart; this requires administrator rights – usually no problem on your own computer. Docker Desktop is free for education, personal use and small businesses; larger companies need a Docker subscription or a free alternative such as Podman or Rancher Desktop.
• About 1–2 GB of free memory while MES.Plot is running.

Install and start (planned, example)

1. Install and start Docker Desktop.
2. Download the file docker-compose.yml from the MES.Plot website and put it into a folder, e.g. MES.Plot.
3. Open a terminal in this folder and start:

   docker compose up -d
   

4. Open http://localhost:8080 in the browser. No sign-in – it is your computer, after all.

Stop with docker compose down, update with docker compose pull and a new start. Your projects are kept in a Docker volume or folder and survive updates. It also works without a terminal via the Docker Desktop interface; the guide shows both ways with screenshots.

Limits

• No sharing via MES.Plot: collaboration works by passing on files or exported projects.
• Backups are up to you: back up the MES.Plot folder together with your other data.
• Updates do not arrive by themselves – MES.Plot deliberately does not check for new versions. We announce new versions on the website.
• The security of your computer itself (antivirus, disk encryption, screen lock) is up to you. We recommend switching on disk encryption (BitLocker or FileVault).

Status: planned. A double-click program without Docker is possible should it turn out that installing Docker puts too many people off.

7. Which variant suits me?

The variants do not exclude each other: exported figures are identical everywhere, and figure settings can be taken from one variant to another: export a project as ZIP (Open … → ZIP or Export → Project as ZIP) and create it in the other variant with Open … → Import project.

8. What applies in every variant

• Your files stay unchanged. MES.Plot stores the Enrichr file exactly as you uploaded it and recalculates every figure from it. Saved figures contain settings, not images.
• No use of your data for other purposes – no analysis, no AI training, no disclosure.
• No advertising or analytics cookies, no tracking, no external fonts or scripts. The website and the app load everything from their own server.
• Administrators cannot see projects, only accounts.
• Everything can be exported and deleted: every project can be downloaded as ZIP – original files unchanged, figures with all settings and all details as JSON, plus a description of the format. The format is open and can be read without MES.Plot. When an account in the cloud is deleted, its backups are gone after 30 days as well.
• Same results everywhere: the calculation is the same program code in every variant and deterministic.

9. Glossary