OWNOMI FIELD NOTES
How to analyze a VCF file privately
Start by deciding where files may live and which systems may receive information from them. Running software on your own computer is useful, but privacy depends on its network connections, storage and access settings too.
Make a small data-flow map
Write down five things: the original file, working copies, tools, external services and outputs. For each, ask who can access it, how long it is retained and how it can be deleted. Include backups, synchronized folders, command logs and screenshots. This is a practical planning checklist, not a guarantee of anonymity.
Compare three ways to work
The right choice depends on the task, your equipment and the responsibility you want to take on. These are workflow models, not a security rating of particular products. Check each provider’s actual terms and configuration.
| Question | Upload service | Local workflow | Customer-controlled cloud |
|---|---|---|---|
| Where do data live? | Copies are sent to the service’s infrastructure. Retention and backups depend on its policy. | On your computer and any backup or synchronized storage you configure. | In resources in your account, in selected regions, plus configured backups. |
| Who may access them? | The service and authorized personnel or subprocessors, subject to its controls and terms. | People and software with access to the device, folders or backups. | Account identities and administrators you authorize; provider access is governed by service controls and terms. |
| Setup complexity | Often lower for supported tasks; formats and available tools may be constrained. | You install, configure and maintain tools and reference resources. | You manage the workflow plus account permissions, storage, networking and costs. |
| Computing requirements | The service supplies processing; your device needs upload capacity and a supported interface. | Your hardware must fit the chosen task, input size, memory and annotation resources. | Resources can be selected for the task, with usage costs and quotas to manage. |
| External data flows | The initial upload is explicit; investigate downstream processing, exports and integrations. | Remote lookups, plugins, telemetry and synchronization may send information out. | APIs, plugins, logs and transfers can cross the selected environment’s boundary. |
| Ongoing control | Exports, deletion, available tools and continued access depend on the service. | You control retained copies and tools, and take responsibility for updates and backups. | You control account resources and access within the provider’s service model; maintenance and billing continue. |
A supported upload service may be simpler. Local work can suit an existing capable computer. Your own cloud can fit tasks that need different resources. None removes the need to understand access and data flows.
A local workflow, with explicit boundaries
Local reference files & annotation cache → Local tools
Review what is sent and received before enabling it.
A cloud workflow needs the same map, with the account and its resources as the boundary instead of your computer. Include support access and exports in either version.
Check what “offline” means
Ensembl VEP can use local annotation caches. Its documentation distinguishes caching from offline operation: database lookups can transmit genomic coordinates, while --offline prevents database connections within that mode. Required reference and cache files must be available locally. Review the chosen options and any additional plugins separately. See Ensembl’s data privacy and offline guidance.
Do a trial with a public or synthetic example before processing personal data. An offline setting in one tool does not configure your backup software or every other component.
Agree on setup access
If someone helps configure the environment, define the work before granting access. Agree whether real files are needed at all, which permissions are required, how access will be recorded and when it will be revoked. Review screen sharing, downloads and support logs as part of the same arrangement.
Keep external services explicit
Do not paste personal records into search engines, public issue trackers or AI assistants as a shortcut. Decide first whether a service is necessary and understand its retention and access terms. Prefer a minimal synthetic example when asking a technical question.
Your preflight checklist
- Original data backed up in an agreed location.
- Tools, reference files and versions documented.
- External connections understood.
- Access and deletion responsibilities agreed.
- Costs and support boundaries written down.
Review the checklist again whenever you add a new tool or change where the workflow runs.