Cradle

The model is the product. Cradle sells software whose core function is a machine learning system: after each round of experiments it fine tunes a project specific model on public protein data, Cradle's own wet lab data and the customer's results, then generates candidate sequences and designs complete experimental plates against several target properties at once (activity, binding, stability, expression). Without the models there is a data workspace and nothing to design with. The Amsterdam wet lab exists to test and improve the models rather than to sell laboratory work; the company says plainly that it is not a contract research organization.

How oversight works is described, and a published accuracy claim carries a universal promise. The customer's scientists set goals, assays and design constraints (template sequences, blocked mutations, regional constraints, custom objectives), review generated candidates and complete plates, and test them in their own lab before uploading results for the next round; no threshold is stated at which a prediction should not be trusted.

The platform page says Cradle automatically builds a custom model after each round "to ensure accurate predictions no matter how far your designs drift from nature". That sentence promises that the model's output holds at every distance from natural sequences, and the lab test that follows does not answer it. A team that believes it has less reason to design the experiments that would show where predictions fail far from nature. The same page's line that the system "automatically de-risks every plate" is about how plates are designed, not about prediction accuracy.

The approach and training data are described, and the models are not named. The platform page says that after each round Cradle automatically fine tunes a project specific model on public datasets, Cradle's own wet lab data and the customer's results, and designs plates by running thousands of simulations that balance exploiting known winners against exploring alternatives; it covers enzymes, peptides, and single and multi chain antibodies. On updates, the home page says the AI "gets better every two weeks", and the security and privacy page says major changes to the machine learning algorithms are benchmarked against public protein databases and internal validation datasets, documented and reviewed before deployment.

What is not published is the identity of the underlying models (a proprietary protein model or an adapted public one), any model version a customer can see, or release notes telling a customer when the system changed.

A structurally short chain: models are trained by Cradle on Google Cloud, and the terms governing customer data are published. The security and privacy page says the platform runs on Google Cloud in the Netherlands with EU replication, uses WorkOS for single sign on and Vanta for compliance monitoring, and that each customer's data and the models trained on it stay in a tenant dedicated to that customer, are never used, shared or deployed outside it, and are deleted within 7 days of contract termination. Models are fine tuned by Cradle on public datasets, its own wet lab data and the customer's results, and no outside model provider is named as receiving customer data.

No subprocessor list is published, and nothing says whether a public pretrained protein model underlies the base model.

Customer case studies and an outside benchmark, short of independent validation, and no designed protein reported in a clinical study. Cradle's home page links case studies with outcome figures: therapeutic peptides engineered with a 50 percent success rate under several property constraints, a Staphylococcus aureus vaccine antigen made 2.5 °C more thermostable in a single round, a stalled IgG antibody campaign that produced 10 candidates meeting potency and developability criteria in three rounds, and a project on producing a vaccine adjuvant. Cradle also took part in the Align to Innovate Protein Engineering Tournament, whose organizers have published its results as a paper; Cradle's account of its enzyme results is on its own blog.

The headline figures, 2 to 12 times faster development across more than 50 programs and candidates rated 8 out of 10 by scientists, are the company's own and carry no method or baseline, and the speed comparisons in the case study titles (5 times faster than prior efforts, 7 times faster than rational design) are the company's as well. No customer has reported a protein designed on the platform entering a clinical study with a timeline, which the category page names as the decisive evidence.

Categorical commitments on customer data, with retention stated only for the end of the contract. Cradle's security and privacy page says customer data is used solely to train machine learning models specific to that customer's projects; that each customer's sequences, experimental results and trained models are strictly isolated; that Cradle never combines or shares data or models between customers; and that models trained on one customer's data are never used, shared or deployed outside that customer's tenant, with platform benchmarking validating the algorithms rather than reusing customer models. The home page repeats that customer data is never used to train models for others. On retention, all customer data is deleted within 7 days of contract termination; no retention schedule during an engagement is stated.

The platform takes in protein sequences, assay results and user account details rather than patient data, and de-identification is not addressed. Safety engineering (guardrails, and how a failure is handled) is not addressed either.

A privacy document reaches the service, and no HIPAA position is taken. The privacy policy (last updated 23 March 2026) covers personal data processed through the Cradle platform as well as the website, naming account, profile and usage data, and the security and privacy page says Cradle acts as a data processor under a Data Processing Addendum where it processes customers' personal data under the GDPR. The same page lists what the platform collects as "primarily" protein sequences, experimental data and basic user information.

Nothing states whether the platform may receive protected health information, for example assay data derived from patient samples, and no business associate position is taken, so the scope is not explained: the collection list is framed as data minimization rather than as a statement that health information is out of scope.

A recognized attestation is named in the vendor's own material, with the artifact behind a trust center. The security and privacy page states that Cradle is SOC 2 Type II certified, covering security, availability and confidentiality controls, and that its status and controls can be viewed in a public trust center at trust.cradle.bio, run on Vanta's compliance automation platform. The security page gives no report date or audit period, and the pages word it three ways: the home page says Cradle is "fully SOC 2 compliant", the compliance section says "SOC 2 Type II certified", and the page's opening says its practices "align with and exceed" SOC 2 Type II, ISO 27001 and GDPR, which for ISO 27001 is alignment, not a certificate.

The controls behind it are described in detail: infrastructure as code with peer review, no standing production access, time limited privileged access approved by a second engineer, air gapped backups with a stated recovery point and time, intrusion detection, endpoint detection, yearly tabletop exercises, and a responsible disclosure policy with acknowledgment within 24 hours.

No device claim is made and the product is scoped as research software. Cradle sells protein design software to biopharma, industrial biotechnology, food and agriculture R&D teams, and nothing on its pages presents the platform as a medical device or makes a clinical claim for it. A therapeutic or vaccine designed on the platform follows its own regulatory path, owned by the customer, which keeps full ownership of the designs; Cradle discloses no clinical pipeline of its own.

Model testing is described as an internal process, and no evaluation of where the model underperforms is published. The security and privacy page says major changes to Cradle's machine learning algorithms are benchmarked against public protein databases and the company's internal validation datasets, documented and reviewed before deployment, and that this benchmarking validates the underlying algorithms without using models trained on one customer's data for anyone else. Cradle also entered the Align to Innovate Protein Engineering Tournament, an open benchmark run by outside organizers with teams from industry and academia, and describes its enzyme results on its own blog.

None of this is a governance framework with named process that a buyer's review committee can evaluate, and no results are published by protein family, modality or amount of training data. That breakdown matters for a product that fits a model to each customer's data: it follows from the design that the model has least to learn from in a project's first round, and how it performs then is not published.

Mechanisms let a customer check and trace an output, with nothing standing behind it. Every design is a candidate the customer's scientists test in their own lab before anything advances, and the platform records provenance: the platform page describes full audit trails of who did what, when and with which data for every table, task and configuration, and an automatic analysis of the quality of uploaded experimental data and of the model's ability to learn from it.

No error rate or hit rate for generated designs is published with a method and denominator (the 2 to 12 times faster timelines and the average scientist rating of 8 out of 10 for candidates carry no method), and no warranty, remediation or fee consequence for designs that fail in the lab is stated. The privacy policy (last updated 23 March 2026) limits Cradle's liability for data handling and says nothing about outputs.

No clinical record integration exists: Cradle is protein engineering software for R&D teams, and no clinical record system is involved. For a pharma or biotech buyer the record systems that matter are its research systems: electronic lab notebooks, laboratory information systems, research data platforms and cloud data environments.

The platform page describes integration in general terms: full API access to connect Cradle to existing pipelines and automate workflows, custom data schemas matching lab workflows through the interface and the API, and, in beta, the customer's own internally developed predictors running inside Cradle. No electronic lab notebook, laboratory information system, data platform or customer deployment is named. The documentation at docs.cradle.bio sits behind a login and may name specific systems.

A single hosted option with residency and tenant isolation documented, and the processing path across borders left open. Cradle runs as a fully managed platform on Google Cloud: the security and privacy page states that customer data is stored in Google Cloud data centers in the Netherlands (the europe-west4 region) and replicated across the EU for redundancy, with backups held in a separate, isolated Google Cloud organization. Each customer's workspace is logically isolated, enforced at the application and infrastructure levels, and every model trained on a customer's data sits in an environment dedicated to that customer. All customer data is deleted within 7 days of contract termination.

What is not stated is where model training compute runs, or where processing happens when staff are granted temporary production access for debugging and customer support; the company operates from Amsterdam and from Zurich, which is outside the EU. No on premises or private cloud option is described.

No price is published; the pricing basis is published without figures. The licensing page describes one annual software license: a Standard license priced per active project for organizations running one to several programs, an Enterprise license for deployment across programs and divisions, and an academic program for not-for-profit research. Every license includes unlimited users, unlimited data upload and storage, compute and infrastructure, API access, full ownership of sequence IP and of the data and reports created, and no royalty or milestone fees.

Every tier routes to a conversation, and no figure, per project rate or minimum is given, so a buyer knows what drives the cost (the number of active projects) but cannot size it before making contact. The IP position, that customers own what they design and pay no royalties, is stated before contact rather than left to negotiation.

Coverage is named broadly, with validation behind part of it. Cradle says its approach works "across modalities and data types" and that "if you can measure it, Cradle can help you optimize it", for pharma, industrial biotechnology, food technology and beyond, and names four modalities: antibodies, enzymes, peptides and vaccines. Case studies on Cradle's site report results for therapeutic peptides, a vaccine antigen, an IgG antibody campaign and vaccine adjuvant production, and Cradle entered an outside enzyme engineering benchmark. Named customers span therapeutics (Johnson & Johnson, AbbVie, Novo Nordisk, Lundbeck), plasma derived medicines (Grifols), industrial enzymes (Novonesis) and agriculture (Corteva).

Validation sits behind the four named modalities; the wider claim to any measurable protein property, and the food and agriculture uses, rest on customer names rather than published results.