Security & Compliance
Compliance is the architecture, not a checkbox
Clinical trial records are regulated records. The platform is built so the compliant path is the only path: audit, versioning, signatures, and access control live in the write path of every regulated record.
Append-only audit trails
Every regulated record change writes who, what, when (UTC), old value, new value, and reason for change in the same database transaction as the change itself. Audit rows are never updated or deleted by any code path.
Versioning, not overwriting
Correcting a captured value creates a new version with a structured reason for change. Prior versions stay queryable forever, and locked or signed values cannot be updated in place.
Part 11 electronic signatures
Signatures bind signer identity, timestamp, and meaning to a specific record version and require re-authentication at signing. If a record changes after signature, every display and export says so instead of silently showing new data under an old signature.
Deny-by-default access control
Every endpoint and query is scoped by study and site membership with role-based permissions. Blinded data is an authorization boundary enforced across endpoints, exports, and notifications alike.
Session and credential controls
Account lockout after repeated failed logins with alerting, password aging, minimum password strength, and automatic inactivity logoff per HIPAA. Signature-gated actions always re-prompt for credentials.
Validation evidence, automated
Regulated behaviors carry dedicated automated test groups that double as objective computer system validation evidence, with a clause-by-clause Part 11 traceability matrix mapping each requirement to its passing tests.
Regulatory scope
The platform is designed and tested against 21 CFR Part 11 (electronic records and signatures), HIPAA (privacy, security, and automatic logoff), and ICH GCP E6(R3) including risk-based quality management, with GDPR readiness for international studies.
No software product is "Part 11 compliant" on its own: the regulation covers your procedures as well as our controls. We publish a shared-responsibility matrix that maps every enforceable clause to either a platform control with its automated evidence or to the customer SOP that owns it, so your quality team knows exactly where the line is.
Each release ships with a generated validation package: requirements traceability, automated test evidence, release notes, and change log, giving your computer system validation file objective evidence instead of vendor promises.
Data handling commitments
- All data encrypted in transit (TLS) and at rest
- PHI never appears in logs, URLs, push notification payloads, or analytics events
- Participant-facing notifications reference tasks, never medical content
- Immutable event timestamps stored in UTC; display timezones applied only at presentation
- Local development and demo environments use fabricated subjects only
- Regulated records export in human-readable and machine-readable form, audit trails included
Run your next study on one platform
Start a 14-day free trial, no payment details required, or talk to us about your site's workflow first.