SOPHiA GENETICS

The analysis is the product, and the analysis is made of models. SOPHiA DDM takes raw sequencing data a laboratory has already generated and returns called, annotated and pre-classified variants: PEPPER calls single nucleotide variants and small insertions and deletions using pattern recognition, MUSKAT, MUSTARD and CARDAMOM detect copy number changes, microsatellite instability and fusions using statistical models fitted to data, GIInger uses a convolutional neural network to score genomic instability from low-pass genome sequencing, and supervised learning on more than two million genomic profiles pre-classifies variant pathogenicity.

The company sells library preparation kits, visualization software (Alamut Visual Plus) and services alongside, and the platform's value is the computation; without the models there is little left to buy.

An external control exists because of how the product is used, and the platform's own design is undescribed. Laboratories run the platform on their own sequencing, and where results are used clinically they are issued under the laboratory's own accreditation, in Dx mode for the CE-IVD applications in Europe or as the laboratory's own validated test in the United States, so a qualified professional at the customer signs out each result. The platform hands that professional called, annotated and pre-classified variants, with interpretation tools alongside.

Pre-classification decides which of many variants reach a scientist first and how they are labeled. Nothing published states what it filters or demotes, whether a reviewer can see past it, what confidence accompanies a classification, or how a result near a threshold is flagged; independent HRD validations found discordance concentrated at the genomic instability threshold, which the product pages do not warn about.

The approach is named model by model, without version or update discipline. The technology principles page names the algorithms and the technique behind each: PEPPER (pattern recognition for SNV and indel calling), MUSKAT (copy number), MUSTARD (microsatellite instability), CARDAMOM (fusions and exon skipping), STAR ANISE (star alleles), GIInger (a convolutional neural network scoring genomic instability from low-pass sequencing), supervised learning on more than two million genomic profiles for pathogenicity pre-classification, and a segmentation network for radiomics. The company says the models are built in house.

What is not published is the training data behind each model beyond that count, how versions are identified in results, and how a laboratory running the platform inside its own validated test learns that a model changed and whether to revalidate. The annual report describes the regulatory expectation for documenting AI updates without describing the company's own practice.

A structurally short chain for the models, with the hosts named. The algorithms are built in house and run on the company's platform, so no outside model provider sits between a laboratory's data and a result. The annual report names Microsoft Azure as the main cloud provider, with AWS and Google Cloud as alternatives, and says third parties provide security operations center services and annual penetration testing; the platform page names NVIDIA GPUs for heavy workloads.

No subprocessor list is published, and the privacy policy says only that third parties handling personal data are held to the company's standards. The shared Community insights mean anonymized, aggregated data from one institution informs results at others, and how that flow is governed is not written down.

Independent, peer reviewed, multi laboratory evaluation of a core AI module, alongside the company's own analytical studies, with the weak spots reported. For the HRD solution, which pairs targeted sequencing with the GIInger deep learning score: a multilaboratory validation at Peter MacCallum Cancer Centre (Fellowes et al., Journal of Molecular Diagnostics 2026; 145 ovarian cancer samples against Myriad myChoice) found 100 percent concordance on BRCA status, strong agreement on genomic instability, 91.2 percent overall accuracy after a threshold adjustment, about 6 percent inconclusive and discordance near the threshold; a technical evaluation by AstraZeneca and Merck (Gynecologic Oncology 2026) compared it with three other commercial assays against myChoice CDx; and an Italian multicenter group compared somatic BRCA detection across four workflows (International Journal of Gynecological Cancer 2026). ESMO's recommendations list the CE-IVD HRD solution as a validated method.

The other modules rest on the company's CE-IVD analytical studies (for example, 155 FFPE samples across 6 centers for solid tumors), and radiomics and multimodal work carry less. The company reports more than 990 institutions and about 36,000 genomic analyses a month, which is scale of use rather than evidence of benefit.

The data path is described specifically, with no retention schedule. The company's data protection flyers (US and international versions, February 2025) say data is de-identified (US) or pseudonymized (elsewhere) on upload, with identifying data and sample IDs stored separately, encrypted at rest and in transit (AES-256, RSA 2048), behind two factor or SAML sign-in; laboratories generate data in house and keep custody of samples and data. The same flyers disclose the secondary use: aggregated, anonymized data across institutions forms the SOPHiA GENETICS Community's collective intelligence, which the annual report says the platform uses to improve as it analyzes more data. French customers' data sits on certified health data hosting (HDS).

What is missing is time: how long uploaded data, results and derived data are kept, and what is returned or deleted when a contract ends. The flyers describe how anonymized insights are shared, not what an institution can opt out of. Safety engineering for the models is not published.

Compliance is claimed and a substantive privacy document reaches the service; no business associate position is stated. The platform page and flyers describe the platform as HIPAA and GDPR compliant, and the US data protection flyer explains how protected health information is handled on upload (de-identified at once, identifying data stored separately, encrypted). That flyer reaches the service. Nothing published says whether the company acts as a business associate of US customers, whether an agreement is available, or which SOPHiA entity signs; the privacy policy (version 5, October 2025) covers website visitors and platform users and says other data is governed by separate contracts.

SOPHiA is headquartered in Switzerland and serves US laboratories, and its published material does not cover whether support staff outside the United States can reach a customer's data or how subcontractors are bound.

Recognized certifications are named with their versions and scope. The company announced in January 2025 that BSI certified it to ISO/IEC 27017:2015 and ISO/IEC 27018:2019 and recertified it to ISO/IEC 27001:2022, first held in 2014. The annual report (Item 16K) says the ISO 27001 scope covers the cloud platform and the company's sites in Switzerland, the United States and France, and lists annual third party penetration testing, monthly security operations center reviews and external audits to ISO 27001, 27017, 27018 and 13485.

The Trust Center link in the site footer opens a Vanta portal, which may hold the certificates themselves. The Cloud Security Alliance registry lists a self-assessed CAIQ (version 3.1) from February 2020, marked deprecated. The ISO 13485 certification covers quality management rather than information security.

The position is stated product by product and territory by territory, with no US clearance. The site footer says SOPHiA products are for research use only unless specified, and names five CE-IVD applications with the territories where each is available (Hereditary Cancer, RNAtarget Oncology and HRD in the EEA, UK and Switzerland; Myeloid and Solid Tumor there and in Israel); the platform flyer says SOPHiA DDM for Genomics is CE marked under IVDR in Dx mode. In the United States no application is FDA cleared or approved, and the annual report explains that US laboratories use research use only applications within their own laboratory developed tests and names compliance with FDA's research use only guidance as a risk.

The CE marks are named without certificate numbers or dates, and the June 2026 memorandum with Memorial Sloan Kettering envisions companion diagnostic work whose regulatory route is not yet stated.

Risk is acknowledged in filings and no evaluation of model behavior across groups is published by the company. The annual report names bias and inaccuracy among the risks of AI systems and describes regulatory expectations for documenting AI updates and managing model drift, and the data protection flyers say the size of the network helps reduce bias. None of that is an evaluation. Variant pre-classification depends on reference data drawn mostly from people of European ancestry, so uncertain classifications are more common in other populations, and a platform sold in 75 countries meets that unevenness directly; no performance by ancestry is published.

Independent laboratories have located one weak zone for one module: in a multilaboratory validation of the HRD solution against Myriad myChoice (Fellowes et al., Journal of Molecular Diagnostics 2026, Peter MacCallum Cancer Centre, 145 samples), discordance concentrated near the clinical threshold for genomic instability and about 6 percent of samples were inconclusive. The company's own pages do not state either finding. How improvements drawn from the shared network are validated before they reach a laboratory's pipeline is not described.

Analytical error rates are published with their method and denominators; nothing makes the company answerable for a result. The annual report gives observed performance by application with the study behind each: somatic oncology from the CE-IVD study of the Solid Tumor Solution (6 sequencing centers, 155 FFPE samples, 192 confirmed variants) at 98.77 percent sensitivity and 100 percent specificity; germline oncology from the Hereditary Cancer Solution study (7 centers, 159 samples, 1,252 confirmed variants) at 100 percent sensitivity and 99.99 percent specificity; rare disease from the Genome in a Bottle trio (2 centers, 9 samples) at 98.93 percent sensitivity; cardiology from two studies of 113 samples and 833 variants. The HRD page reports 92.91 percent overall agreement with centralized reference methods for GIInger.

No warranty, indemnity or remediation obligation attaches to a result, and the website terms disclaim warranties. For laboratories running the platform inside their own validated tests, how a model update is identified and communicated, so the laboratory knows whether to revalidate, is not described.

Integration is claimed with no system named. The platform page and flyer describe seamless, automated data transfer between technologies, EHR, LIMS and interpretation tools, and the company describes the platform as technology agnostic across sequencing instruments, which is what lets laboratories keep the sequencers they own. No record system, laboratory information system, sequencer model, interface standard or live connection is named, and the annual report names only an API link between the platform and its own Alamut software.

The validated instruments and file formats are not listed, and nothing says how variant calls reach the laboratory information system and the chart, or whether they arrive as structured data or a report.

Hosting and part of the residency picture are stated, with regions left open. The annual report says the platform runs mainly on Microsoft Azure and can be deployed on AWS or Google Cloud; the data protection flyers describe cloud and regional data centers for analysis and storage and network isolation between environments, the platform page says samples run on their own cloud nodes, and the privacy policy says French customers' data is hosted on certified health data hosting (HDS) and that data may be transferred to Switzerland or other countries where the company operates under standard contractual clauses.

Which region a given customer's data rests in, whether processing for the shared Community insights crosses a border, and how tenants are separated in practice are not published.

No price is published and the posture is discoverable. The annual report states the company earns revenue on a pay-per-analysis basis, with application and product pricing, the access model and customer size also affecting revenue, and describes bundle solutions that pair the platform with third party products in the testing workflow. A buyer therefore knows the unit of charge (an analysis) before calling, but no rate, tier or volume band is published, and demo requests are the route in.

Coverage is named precisely, and validation stands behind part of it. The platform serves hospital and laboratory genomics in oncology (solid tumors, blood cancers, hereditary cancers, liquid biopsy, HRD) and rare and inherited disorders, with radiomics and multimodal modules for research, across more than 990 institutions. The regulatory boundary is stated per product and territory: five CE-IVD applications in named European territories and Israel, research use only everywhere else unless specified.

The evidence differs by module. HRD has independent multilaboratory validation, the CE-IVD applications have the company's analytical studies, and the radiomics and multimodal modules (for example, the UroCCR kidney cancer recurrence model) are presented alongside them with thinner published support.