this page exists so that a security review can be finished without booking a call. the controls are listed by state — in the product, or committed and not yet shipped. everything that is unproven is named on this page as unproven, in the same list as everything that is not.
written for the person filling in the vendor questionnaire: the site's IT or security lead, or a sponsor's quality officer. if an answer here is not enough, the same answers are given in writing, in your format, without a meeting.
two states, and nothing in between them. a control is in the product, or it is committed and has not shipped. we do not carry a third column for work that is being thought about, because a questionnaire cannot be answered with an intention.
in the product
committed, and not yet shipped
a dash means engineering has not given us the date yet, and we would rather show you the gap than a number we made up. when a date is set it appears here, and when the thing ships the badge changes.
certification status is confirmed in writing during the security review, not asserted on a web page. we also do not describe the product as "Part 11 compliant" or as "validated" — the FDA does not certify eClinical software, and validation belongs to your intended use. a validation package is available to support yours.2
a CTMS is a thing you open. an operating system runs whether you open it or not. twelve scheduled checks run against your studies on their own clock — the deadline you would have missed is found at 06:00 whether anyone logged in that morning or not. they are listed here with their cadence because a reviewer is entitled to know what executes without a human present.
times are the schedule the platform runs on. a check that fails is a line in the sync log, and the sync log sweep is itself one of the twelve.
most software in clinical research is written so that leaving is expensive. ours is written the other way, and it is written into the agreement rather than into the marketing. these are the clauses, not a description of them. open any one.
no sponsor, CRO or monitor can remove your access to your own studies. the administrator rights sit with the site, and a commercial dispute you are not party to cannot make your protocol unreachable.
a sponsor invited into your organisation is a reader inside your account. they are not a co-owner of it, and there is no path by which their contract with us changes yours.
source, documents and the audit trail belong to the site. full export in a readable format, at any time, with no fee and without asking us first. an export you cannot open is not an export.
because the record is one record, the export is the whole thing — not the fraction of it one module happened to hold. the audit trail comes with it, as an audit pack, not as a screenshot.
this is not our preference, it is a regulator's. EMA's qualification opinion on eSource direct data capture holds that the investigator must retain continuous access and control of the data during and after the trial, and that eliminating sponsor-independent source data would significantly affect data integrity.4
a system the sponsor provides for one study cannot satisfy that once the study closes. yours can, which is the reason the account sits where it does.
when a study closes, read access to it stays available to your site at no cost, with no end date, and with no requirement to hold a paid study line to reach it. an inspector can arrive four years later and you can still answer.
this is the clause most vendors will not sign. ask your other vendors for it in writing and compare what comes back.
no retention call, no exit interview, no requirement to explain. the timings are fixed and they are in the agreement:1
export bundle available within 14 days of termination · you elect return or deletion within 30 days · deletion completes within 30 days of that election · written certificate of deletion within 10 business days of completion.
sixty days is the outside case, and the certificate is a document you can file, not an email saying it is done.
naming the limit is faster than being asked. a review that finds these on the page instead of in a call is a shorter review.
the sponsor selects and licenses the EDC. we remove the first transcription and hand your coordinator one screen to key from. a direct feed exists only where that sponsor switches it on — we will not pretend otherwise, and we will not name a system we have no write path into.
a sponsor can read your site through _sync. they cannot own your account, change your configuration, or take your data at the end of a protocol. the read is scoped to the protocol they are delegated to, and it ends when the delegation does.
the eTMF, the IRB system, the central lab portal stay where they are. we connect to them so the visit stops being typed into each one. if your contract obliges you to use a named system, this changes nothing about that obligation.
fewer than five trials with no plan to grow, or halfway through another implementation — we will say so on the first call, before you spend a meeting on it. a review that ends in "not yet" is a good outcome for both of us.
ask these of every system that touches your trial data, including this one. our answers are below, and where the honest answer is unflattering it is written that way rather than left out.
the site organisation holds it, and non-payment does not move it to a sponsor, a CRO or to us. what non-payment does is start the exit written in section 03 — you tell us you are leaving, the export bundle is available within 14 days of termination, and read access to closed studies survives at no cost.
the unflattering half: an account is only as durable as the company behind it, and we are a small one. that is why the protection you should rely on is the export and the read access, which do not need us to be healthy to work.
yes, and you should refuse to sign with anyone who says no. we will produce a full export in front of you and open it, so you can see the format rather than be told about it.
the honest caveat: today it comes off a study built and run end to end on synthetic data,3 because there is no customer data in the product to export. the format is the format; the content is invented, and we say which is which as we go.
it is retained to the regulatory floor of seven years, it stays immutable, and it stays readable by your site with no end date and no fee. it exports as an audit pack.
two of the twelve scheduled checks exist for this: retention expiry notifications tell you before anything moves, and the audit TTL backstop runs a second pass over audit-trail lifetimes so retention does not depend on the first pass having worked.
a direct feed into a sponsor's EDC exists only where that sponsor switches it on. where it is not switched on, the answer is read or nothing, and we say read or nothing. sponsor access to your site is read-only in every case.
we answer this connection by connection, in writing, during the review — because the true answer depends on which systems you actually run, and a page that claimed otherwise would be claiming to know your stack.
the platform is hosted on Google Cloud, in us-central1, in the united states. the full subprocessor list is provided in writing during the review, current at the date it is given, with notice of changes written into the agreement.
we do not publish the list on this page, because a list published here would be the version that was true in august. the one you should hold is the one attached to your agreement.
an acquirer inherits the agreement, including the ownership clauses, the export right and the exit timings. those survive a change of control because they are contract terms, not policy.
what no agreement can promise you is the acquirer's intentions, their pricing, or their roadmap. so the correct protection is the one that works on day one of any such event: your export is available at any time, with no fee and without asking us first. take one periodically. we would.
99.5% monthly, and it is contractual — it sits in the agreement, not in a marketing page, and there is a public status page so you are not asking us whether we are down.
read it plainly before you sign: 0.5% of a month is not nothing. we publish the number we are willing to be held to rather than the number that would look best next to somebody else's.
send us your questionnaire in whatever format your organisation uses. we complete it in writing and return it. certification status is confirmed in writing during that review, not asserted on a web page — so where the answer is "not held", the document you get back says not held.
this page is the same content, given first, so that most of the questionnaire is already answered before it reaches us.
the short list of things a reviewer would find out later. we would rather you find them out now, from us, than in month three.
nothing in this section is expected to move because we said it here. it moves when it is done, and then it moves out of this section and into section 01 with a badge on it.