Designed for regulated clinical research
Every module, data point and workflow is designed for regulatory inspection. The status of each framework is stated below; nothing on this page is a certification claim.
Regulatory frameworks
Status per framework, stated as designed to, designed for, in progress or targeted.
ALCOA++
Designed toThe platform is designed to ALCOA++ data-integrity principles; every record is attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring and available, and exposed through the audit trail. ALCOA++ is a set of principles, not a certification.
EU GDPR
Designed toDesigned to GDPR requirements, with a Data Protection Impact Assessment per study, an Article 28 data processing agreement, and EU hosting by default.
HIPAA
Designed for alignmentPlatform architecture is designed for HIPAA Administrative, Physical, and Technical Safeguards alignment, including minimum-necessary access, protected health information de-identification pathways, and comprehensive audit logging. Business Associate Agreement program and United States Security Rule attestation are part of our US market expansion roadmap.
ISO 27001
In progressAn information security management system programme is in progress at the application layer; the certification date will be published when fixed.
ISO 13485
In progressA quality management system programme for medical device software is in progress with an external certification partner; no certificate has been issued to date.
ICH E6(R3) GCP
Designed forThe architecture is designed for ICH E6(R3), including Annex 2 on decentralised elements, which takes effect in the European Union on 15 January 2027. The validation dossier is planned.
FDA 21 CFR Part 11
Designed forElectronic records and audit trails designed for 21 CFR Part 11; formal validation is planned.
EU MDR
TargetedThe platform is positioned as software as a medical device, Class IIb under EU MDR 2017/745 Annex VIII Rule 11, with CE marking targeted for 2028 through a notified body. No certificate has been issued to date.
Data Security & Infrastructure
Security architecture on Microsoft Azure with defence-in-depth protection.
Microsoft Azure, European Union regions
The platform is hosted on Microsoft Azure in European Union regions, with EU hosting by default and regional residency on request.
AES-256 Encryption
All data encrypted at rest using AES-256 encryption. Database-level encryption with customer-managed key options for maximum control.
TLS 1.2 or above in transit
All data in transit protected with TLS 1.2 or above, with HSTS enabled across all API endpoints.
Data Residency Controls
Choose where your data lives. EU hosting by default, with regional residency configurations on request.
Role-Based Access Control
Granular RBAC with study-level, site level, and module-level permission matrices. Principle of least privilege enforced across all user roles.
Multi-Factor Authentication
Mandatory MFA for all user accounts with support for TOTP, hardware security keys, and SSO integration with enterprise identity providers.
Comprehensive Audit Logging
Every user action, data access, and system event logged with immutable, tamper-evident audit trails. Exportable for regulatory inspections.
Penetration Testing
Scheduled third-party penetration testing as part of the ISO 27001 programme, with continuous vulnerability scanning across platform components.
ICH E6(R3) Annex 2 readiness assessment
A fixed-scope review of a study's remote data flows against Annex 2 expectations, which take effect in the European Union on 15 January 2027. Delivered as a written report with a gap list.
Public Recognitions and Certifications
Formal certifications and government-issued eligibility held by Vitruvian Shield group entities.
Armenia High-Tech Sector Certification
Granting preferential tax treatment for qualifying information technology activities, held by Vitruvian Shield AM.
Regulatory frameworks
Questions and answers
Compliance and security questions
Is Vitruvian Shield ISO 27001 certified?
No. An information security management system programme is in progress at the application layer. The certification date will be published when it is set. Hosting suppliers' certifications are not presented as the company's own.
Is Vitruvian Shield ISO 13485 certified or CE marked?
No certificate has been issued to date. The ISO 13485 programme is in progress, and CE marking as Class IIb software as a medical device under EU MDR is targeted for 2028 through a notified body.
Does the platform meet FDA 21 CFR Part 11?
Electronic records and audit trails are designed for 21 CFR Part 11. Formal validation is planned and has not been completed.
How are GDPR and HIPAA addressed?
The platform is designed to GDPR requirements, with a data protection impact assessment per study, an Article 28 data processing agreement and EU hosting by default on Microsoft Azure. The architecture is designed for alignment with the HIPAA Administrative, Physical and Technical Safeguards; a Business Associate Agreement programme is part of the US market roadmap.
What does ALCOA++ mean for Vitruvian Shield?
ALCOA++ is the set of data-integrity principles regulators expect of clinical data: attributable, legible, contemporaneous, original and accurate, plus complete, consistent, enduring, available and traceable. The platform is designed to these principles. ALCOA++ is a design standard, not a certification.
How do we obtain security and compliance documentation?
Through the Trust Portal, which lists the status of each framework, the document library available on request, sub-processors, security practices, the vulnerability disclosure process and the audit roadmap.