Maintenance and future perspectives

A short intro to maintaining a data service

Osvaldo Burastero

Former ARISE Fellow, EMBL Hamburg

Garcia-Alai Team

October 6, 2026

Which lifeguard is better?

Assuming the exact same conditions:

A) Four rescues in one month or B) Zero rescues in one month

(B)

The best lifeguard is the one who never needs to perform a rescue.

Because risks were prevented before they became incidents.

Research software abandonment

<< We screened the availability of 2396 web tools published during the past 10 years. In a 133-day test frame, 31% of tools were always working, 48.4% occasionally and 20.6% never. >>

<< Our empirical analysis of 24,490 omics software resources published from 2000 to 2017 shows that 26% of all omics software resources are not currently accessible through URLs published in the original paper. >>

The problem of maintenance

  1. Biology interpretation and data analysis depend on software
  1. Many of the tools are developed by trainees, PhD students and postdocs
  1. Funding encourages new applications, not maintenance
  1. Circa one every four published tools becomes inaccesible
  1. Therefore, maintenance must be planned as part of service delivery from the very beggining

The hidden reality of maintenance

From theory to practice - the eSPC platform

Documentation

Purpose:

  • For fellow developers
  • For external developers
  • For end users

eSPC:

Testing

Purpose1:

  • To discover and prevent possible bugs
  • Safety net to allow adding code without breaking previous functionalities

Types:

  • Manual (performed by a person)
  • Automated (performed by a machine)

Testing

Types of tests:

  • Unit tests: for individual methods

  • Integration tests: modules working together

Testing

Types of tests:

  • Unit tests: for individual methods

  • Integration tests: modules working together

  • End-to-end: Replicate user-behaviour

  • etc1…

Testing

eSPC examples:

Unit test

User-workflow

Dependencies

Challenges:

  • Changes in dependencies may break the current code.

Solution:

  • Use computational environment with fixed/pinned versions. For instance, uv for python and renv for R.

  • Have tests so newer software versions can be easily validated.

Dependencies

The licenses of the dependencies condition the license of your service

Case in EMBL: Change of license terms from Anaconda

Security updates

Purpose: To patch software vulnerabilities and avoid unauthorized access to data or service disruptions

Recommendations:

  • Monitor the programs that are used and for those which do not update automatically, scout regularly for updates
  • Do regular backups!1

Security requirements @EMBL

  • Service needs to have a technical owner responsible for updating the service
  • Asset data needs to be classified according to its sensitivity
  • Service should be isolated and connections encrypted
  • In case of a Security incident, the technical owner must contact the Computer Security Incident Response Team and the Data Protection Office1

Security @eSPC

User support - GDPR compliance

If you process data you have to do so:1

  • Lawful, fair and transparent to the data subject
  • For legitimate purposes specified at the moment of data collection
  • Collect only necessary data
  • Keep personal data up to date
  • Ensure integrity and confidentiality of the data
  • Be accountable

User support - Internal Policy No 68 @EMBL

Data subjects have the right1

  • that no significant decisions are taken without human intervetion
  • request the processed data in a clear and understandable format
  • to know the reasons for processing and object it
  • request rectification or removal of data
  • withdrawn consent at any time

Future perspectives

Integrating AI in online data services

For your project you should evaluate that

  • AI agents will interact with your service:
    • Provide a well-documented API
    • Use machine-readable data
    • Include rich metadata
    • Enable automation and bulk operations
    • Enforce rate limits and/or access control mechanisms

Integrating AI in online data services

For your project you should evaluate if:

  • LLMs will be available inside the service for users to help them:
    • Depositing data
    • Processing data
    • Visualizing data
    • Analysing data
    • Searching data
    • Fetching data

Integrating AI @eSPC

We started building MCP servers that will let users analyse the data by chatting

Caution notes:
  • Responses may not be deterministic (e.g., depend on the LLM model)
  • There is risk of hallucination if the tool response is altered by the LLM

Thank you!

  • EMBL Garcia-Alai Team
  • EMBL Hamburg IT Team