Designed for regulated clinical research
Every module, data point and workflow is designed for regulatory inspection. The status of each framework is stated below; nothing on this page is a certification claim.
Regulatory frameworks
Status per framework, stated as designed to, designed for, in progress or targeted.
ALCOA++
Designed toThe platform is designed to ALCOA++ data-integrity principles; every record is attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring and available, and exposed through the audit trail. ALCOA++ is a set of principles, not a certification.
EU GDPR
Designed toDesigned to GDPR requirements, with a Data Protection Impact Assessment per study, an Article 28 data processing agreement, and EU hosting by default.
HIPAA
Designed for alignmentPlatform architecture is designed for HIPAA Administrative, Physical, and Technical Safeguards alignment, including minimum-necessary access, protected health information de-identification pathways, and comprehensive audit logging. Business Associate Agreement program and United States Security Rule attestation are part of our US market expansion roadmap.
ISO 27001
In progressAn information security management system programme is in progress at the application layer; the certification date will be published when fixed.
ISO 13485
In progressA quality management system programme for medical device software is in progress with an external certification partner; no certificate has been issued to date.
ICH E6(R3) GCP
Designed forThe architecture is designed for ICH E6(R3), including Annex 2 on decentralised elements, which takes effect in the European Union on 15 January 2027. The validation dossier is planned.
FDA 21 CFR Part 11
Designed forElectronic records and audit trails designed for 21 CFR Part 11; formal validation is planned.
EU MDR
TargetedThe platform is positioned as software as a medical device, Class IIb under EU MDR 2017/745 Annex VIII Rule 11, with CE marking targeted for 2028 through a notified body. No certificate has been issued to date.
Data Security & Infrastructure
Security architecture on Microsoft Azure with defence-in-depth protection.
Microsoft Azure, European Union regions
The platform is hosted on Microsoft Azure in European Union regions, with EU hosting by default and regional residency on request.
AES-256 Encryption
All data encrypted at rest using AES-256 encryption. Database-level encryption with customer-managed key options for maximum control.
TLS 1.2 or above in transit
All data in transit protected with TLS 1.2 or above, with HSTS enabled across all API endpoints.
Data Residency Controls
Choose where your data lives. EU hosting by default, with regional residency configurations on request.
Role-Based Access Control
Granular RBAC with study-level, site level, and module-level permission matrices. Principle of least privilege enforced across all user roles.
Multi-Factor Authentication
Mandatory MFA for all user accounts with support for TOTP, hardware security keys, and SSO integration with enterprise identity providers.
Comprehensive Audit Logging
Every user action, data access, and system event logged with immutable, tamper-evident audit trails. Exportable for regulatory inspections.
Penetration Testing
Scheduled third-party penetration testing as part of the ISO 27001 programme, with continuous vulnerability scanning across platform components.
ICH E6(R3) Annex 2 readiness assessment
A fixed-scope review of a study's remote data flows against Annex 2 expectations, which take effect in the European Union on 15 January 2027. Delivered as a written report with a gap list.
Public Recognitions and Certifications
Formal certifications and government-issued eligibility held by Vitruvian Shield group entities.
ANI Idoneidade Cientifica
Portuguese national certification for research and development scientific idoneity, held by Vitruvian Shield PT LDA.
Armenia High-Tech Sector Certification
Granting preferential tax treatment for qualifying information technology activities, held by Vitruvian Shield AM.
SIFIDE II Eligibility
Portuguese research and development tax incentives applied to qualifying R&D activities.