The record has to stand up in an inspection.
Sponsors and CROs do not buy a badge wall. They buy a system that can reconstruct who did what, when, and why — under the same permissions the people in the room already have.
- Append-only trail
- Row-level security
- Human-in-the-loop AI
The stack
Six controls, in the order they actually stack
Identity, then access, then isolation, then the trail, then the human gate, then the review of all of it. Each layer assumes the one above it is already true.
- 01
Unique identity
Every person has their own account. Multi-factor authentication is available on every seat, and organization admins can require it.
- 02
Access that matches the org chart
Roles are scoped to the study and the site, not to a shared password. A monitor on three sites sees those three sites — not the portfolio.
- 03
Isolation in the database
Row-level security is enforced in Postgres on every query. The application cannot talk its way past a row it is not allowed to read.
- 04
An append-only audit trail
Creates, updates, and deletes carry who, what, and when. Version history is retained. The trail is reviewable at study and organization level, and it is not editable by standard users.
- 05
A human gate on AI
The Copilot reads through the same permissions as the person using it. Anything that would change data is proposed first and waits for an explicit approval. Agent writes are attributable in the trail.
- 06
Review that is itself audited
Periodic access reviews, scoped client access for sponsors, and break-glass procedures that write their own record. Oversight is a workflow, not a policy PDF.
Regulatory posture
Ready is a design, not a certificate
Every plan ships HIPAA-ready and GDPR-ready controls, and a Part 11-style audit trail with e-signature. We do not display certifications we have not earned. If a questionnaire needs a packet, we send the packet.
HIPAA-ready
Encryption in transit and at rest, least-privilege access, audit logs, and breach-notification procedures. A Business Associate Agreement is available on request.
GDPR-ready
Lawful-basis processing, data-subject access and portability, and erasure by pseudonymization. The audit trail is retained on a legal-obligation basis rather than deleted out of existence.
Part 11-style records
Unique authentication, time-stamped attributable records, reason-for-change on controlled transitions, and electronic signature on the workflows that require one. This is the trail the product keeps — not a completed validation package.
Vendor qualification
Ask for the packet, not the badge
Security questionnaires, a Business Associate Agreement, subprocessor details, and hosting location are answered in writing. A validation package is a services deliverable with a delivery date — not a checkmark on the pricing card.
Email security@trialetics.io or use the contact form. Related: our Privacy Policy and Terms & Conditions.
Run your next trial from one command center
See your own workflows in Trialetics — we'll walk through your studies, not a canned demo.