Sandbox Software Inventory

Version 2026-10 — Effective October 9, 2026

This page is an appendix to our Open-Source Software Notices. It enumerates, component by component, the independent scientific software installed in the analysis sandbox image that Ploid's compute tier runs — the detail behind Section 7 of that document.

Each component listed here is the property of its respective copyright holders and is used under the terms of its own license. Every program is invoked as a separate executable, and every package is loaded by the language runtime that installed it; none is linked into, or distributed as part of, any Ploid code. Nothing in this document grants you any right in these components beyond what their own licenses provide.

How this list was produced. The licenses below were read from the built image itself — from each R package's DESCRIPTION, each Python distribution's metadata, each Debian package's machine-readable copyright file, and the license text each vendored program ships. They therefore describe the artifact that actually runs, which is not always the same as the license on the project's current homepage.

Scope. This page lists the components the image installs by name. It does not list the several hundred further packages pulled in automatically as dependencies of those components, nor does it restate the platform's own libraries, which are in Sections 2 to 6 of the main notices. A complete, machine-generated bill of materials including transitive dependencies is available on request.

Versions. Where a version is given, it is pinned in the image build. R and Python packages are deliberately shown without versions: they resolve at build time from a dated package-manager snapshot, so the version moves when the image is rebuilt while the license does not.

A1. Bioinformatics command-line tools

Installed from the Debian package archive. Licenses are as stated by each package's copyright file; where a package embeds third-party code under other terms, the license shown is the one governing the program itself.

Installed from their publishers' own releases rather than from Debian:

Every program in this image is open source, under an OSI-approved license. Each is used unmodified, as an independent analysis program.

A2. Vendored analysis programs

Cloned from their source repositories into the image and invoked as standalone programs. None is linked into any Ploid code.

Both are used unmodified, pinned to an exact upstream commit. Ploid patches nothing in this image, so nothing here carries a modified-work obligation.

A3. R packages — CRAN

Installed from a dated snapshot of the Posit Public Package Manager mirror of CRAN. Predominantly copyleft: of the 77 packages below, 49 are under a GNU license (GPL or LGPL, in various versions), 21 are MIT, 4 are Apache-2.0, one is dual LGPL-3.0 or Apache-2.0, and one each is Artistic-2.0 and MPL-2.0. All are used unmodified, loaded by the R runtime, and never distributed to users.

A4. R packages — Bioconductor

Installed from the Bioconductor repository. Roughly half are under the Artistic-2.0 license, which is Bioconductor's house default; the remainder are GNU-licensed or MIT.

The GO.db and DO.db annotation databases above package Gene Ontology and Disease Ontology content; see Section A7 on the terms attaching to the underlying data as distinct from the packaging.

A5. R packages — installed from source repositories

Five packages are not distributed through CRAN or Bioconductor and are compiled into the image directly from their public source repositories. The license shown is the one declared in each package's own DESCRIPTION file.

A6. Python packages

Installed from the Python Package Index. Predominantly permissive — BSD, MIT and Apache-2.0. The exceptions are the copyleft packages shown in bold, and the dual-licensed and file-level copyleft packages explained below the table.

The strongly copyleft Python libraries in the image are pingouin, a statistics library; pymupdf, described below; and eight sequence-analysis and phylogenetics libraries: ete3, pyfamsa, pyrodigal, pyrodigal-gv, pytrimal, taxopy, tmtools and toytree. All are used unmodified, are imported by analysis code running inside a customer's own sandbox rather than by any Ploid service, and are not distributed by Ploid. All but pymupdf are under version 3 of the GNU General Public License, pyfamsa and pyrodigal "or any later version".

toytree states its terms inconsistently: its package metadata declares GPL-3.0, while the license file it ships is BSD-3-Clause. This page lists the stricter of the two.

pymupdf reads and renders PDF documents. Its publisher dual-licenses it under the GNU Affero General Public License v3 or an Artifex commercial license; Ploid holds no commercial license and therefore uses it under the AGPL. The clause that distinguishes the AGPL from the GPL is its Section 13, which extends obligations to users interacting over a network only where a modified version of the program is made available to them. Ploid does not modify it. See Section 9 of the main notices.

tqdm is dual-licensed, its progress-bar core under MPL-2.0 and the remainder under MIT, and gemmi, which reads macromolecular structure files, is under MPL-2.0. The Mozilla Public License is a file-level copyleft that attaches only to modified files of the library itself; both are used unmodified.

odfpy reads and writes OpenDocument files. Its author distributes it under the GNU General Public License v2 or later, or the Apache License 2.0, at the recipient's option; Ploid elects Apache-2.0. It is used unmodified. Its package metadata is not a reliable guide here — it declares three licence classifiers and no licence field, and some module headers still carry an older LGPL notice — so the option grant above is the one the project's own redistribution statement makes.

A7. Models and reference data retrieved at run time

Nothing in this section is contained in any Ploid image or redistributed by Ploid. Each item is fetched from its publisher, into the customer's own sandbox, at the customer's direction — the same posture the main notices describe for packages a customer installs into a sandbox themselves.

Pretrained model weights. The image contains no pretrained model weights, and none is baked into it. A study that needs a pretrained model retrieves it from its publisher into its own sandbox; the model-weight hosts reachable in restricted network mode are the general publisher and hub endpoints (Meta's fair-esm checkpoint host and the Hugging Face hub among them). The license on any model a study chooses to download is the publisher's, and it is the study's responsibility to check it — a model published without declared terms is not licensed merely because it is downloadable.

Reference and annotation data. Analyses running in a sandbox may query the public biological databases below. These are data sources, not software, and several carry attribution terms that are independent of the license on the client library used to reach them. Customers publishing results derived from them are responsible for the attribution their terms require.

The license on the client library says nothing about the license on the data it retrieves. The ChEMBL client in Section A6 is Apache-2.0, for instance, while ChEMBL's own content is CC BY-SA 3.0.

Outbound access is restricted to an explicit host allowlist. The allowlist decides which hosts a sandbox can reach; it grants no permission to use what they serve. Each source above publishes its data under its own terms, and some of those terms are narrower than the software licences in this inventory: a database may condition commercial use, embargo unpublished datasets, or require share-alike. Data a sandbox retrieves is fetched at the customer's direction and used under its publisher's terms. Ploid does not copy it into any image or into storage Ploid operates, and holds no data licence on the customer's behalf. Reference data that Ploid does host itself is a separate matter, held only where its terms permit commercial use, and is listed in the Reference Database Notices.

The UCSC entry covers its download server, for genome assembly data only; the UCSC Genome Browser software, which does require a commercial license, is neither installed nor used.

Besides the data sources above, the allowlist admits three further categories, listed here so that it is complete rather than illustrative:

• Package repositories — CRAN, Bioconductor and PyPI, and GitHub for packages and release files published there, covered under "R and Python packages" below.
• Model weight publishers — Meta's fair-esm checkpoint host and the Hugging Face hub, covered under "Pretrained model weights" above.
• Literature and identifier resolution — Europe PMC, bioRxiv, doi.org, and the sites of several publishers, so that an analysis can resolve a citation or retrieve an open-access article. Published articles are the copyright of their publishers or authors and are not licensed by Ploid. Reachability is not permission: what you may do with an article you retrieve is governed by that publisher's terms and by your own institutional subscriptions, not by this document.

Attribution statements. Where a source is published under Creative Commons terms, this is the attribution it calls for. Reproduce it wherever you publish results derived from that source:

• ChEMBL — "Data from ChEMBL, European Molecular Biology Laboratory — European Bioinformatics Institute (EMBL-EBI), used under CC BY-SA 3.0." CC BY-SA additionally requires that a derived dataset you distribute be licensed on the same terms.
• Reactome, including the reactome.db annotation package — "Data from Reactome, used under CC BY 4.0."
• Gene Ontology — "Data from the Gene Ontology Consortium, used under CC BY 4.0."
• UniProt — "Data from UniProt, The UniProt Consortium, used under CC BY 4.0."
• AlphaFold DB — "Structure predictions from the AlphaFold Protein Structure Database, Google DeepMind and EMBL-EBI, used under CC BY 4.0."
• GTDB — "Taxonomy from the Genome Taxonomy Database (GTDB), used under CC BY-SA 4.0." Share-alike applies to a derived dataset you distribute.
• SPIRE — "Data from SPIRE, European Molecular Biology Laboratory (EMBL), used under CC BY-SA 4.0." Share-alike applies here too.

Ensembl asks for attribution without imposing it as a license condition; NCBI content is U.S. Government public domain and needs none, and RCSB PDB content is dedicated to the public domain under CC0.

R and Python packages. A sandbox can also install further packages from CRAN, Bioconductor and PyPI at the customer's direction. Those are retrieved from the upstream repository, are not redistributed by Ploid and are not contained in any Ploid image; each remains subject to its own license.

A8. Contact

To request the complete machine-generated bill of materials including transitive dependencies, to obtain the full text or corresponding source of any component listed here, or to report a suspected attribution error, contact:

Ploid AI Biotech, S.L. Email: legal@ploid.ai