Everything procurement, security, and compliance teams need to evaluate Vitruvian Shield, in one place.
Status against the frameworks relevant to clinical research software in our target markets, stated as designed to, designed for, in progress or targeted.
The platform is designed to ALCOA++ data-integrity principles; every record is attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring and available, and exposed through the audit trail. ALCOA++ is a set of principles, not a certification.
Designed to GDPR requirements, with a Data Protection Impact Assessment per study, an Article 28 data processing agreement, and EU hosting by default.
Platform architecture is designed for HIPAA Administrative, Physical, and Technical Safeguards alignment, including minimum-necessary access, protected health information de-identification pathways, and comprehensive audit logging.
An information security management system programme is in progress at the application layer; the certification date will be published when fixed.
A quality management system programme for medical device software is in progress with an external certification partner; no certificate has been issued to date.
The architecture is designed for ICH E6(R3), including Annex 2 on decentralised elements, which takes effect in the European Union on 15 January 2027. The validation dossier is planned.
Electronic records and audit trails designed for 21 CFR Part 11; formal validation is planned.
The platform is positioned as software as a medical device, Class IIb under EU MDR 2017/745 Annex VIII Rule 11, with CE marking targeted for 2028 through a notified body. No certificate has been issued to date.
Download what's already published, or request what isn't through the inline form. Requests are reviewed within two business days.
Template drafted to GDPR Article 28 for use between Vitruvian Shield and customer controllers.
Data Protection Impact Assessment template prefilled with platform-specific data flows and risk categorisation.
Computer system validation summary covering electronic records, audit trails, electronic signatures, and the open-system controls applicable to a SaaS platform.
Detailed specification of the immutable audit trail, event taxonomy, retention policy, and customer-export endpoints.
Pre-filled vendor security questionnaire covering organisational security, access control, cryptography, incident response, business continuity, and sub-processor management.
Third parties processing data on behalf of Vitruvian Shield, with their purpose, processing location, and security certifications.
| Sub-processor | Purpose | Processing locations | Certifications |
|---|---|---|---|
| Vercel Inc. | Web application hosting (marketing site) and edge delivery | USEU | SOC 2 Type II, ISO 27001 |
| Resend (Drift Net Inc.) | Transactional email delivery for marketing forms | US | SOC 2 Type II |
| Google Analytics (Google LLC) | Anonymised website traffic analytics. No clinical platform data. | USEU | ISO 27001, ISO 27017, ISO 27018 |
Sub-processor changes are notified to customers in advance. Clinical platform data is hosted in the EU by default; ask about regional residency options at procurement time.
How Vitruvian Shield protects clinical data and platform access.
Access to platform data follows least-privilege principles. Every customer-side action is authenticated, authorised against a role and project scope, and recorded in an immutable audit trail. Administrative access to production systems is restricted to a named operations team, gated by multi-factor authentication and logged independently.
Clinical data is encrypted at rest with AES-256 and in transit with TLS 1.2 or above, with HSTS enabled. Encryption keys are managed by the cloud provider's key management service and rotated on the provider's schedule, with operator access policies enforced at the key layer rather than the application layer.
Application dependencies are tracked in a continuously updated Software Bill of Materials. Security advisories against direct and transitive dependencies are triaged within one business day for critical vulnerabilities, with patches applied through the standard release pipeline. The SBOM is available to customers on request via the Document Library.
Incident response follows a documented runbook covering detection, triage, containment, eradication, recovery, and post-incident review. Customers affected by an incident are notified within the windows mandated by the applicable regulation (24 hours for many GDPR cases).
Independent security testing and a published path for researchers to report issues responsibly.
Pending Publication
External web application and API surface, with grey-box methodology against the staging environment.
Security researchers who believe they have found a vulnerability in Vitruvian Shield are encouraged to report it through the contact below. Reports are acknowledged within 72 hours and triaged within five business days. We do not pursue legal action against researchers who follow our disclosure policy.
Target sequence and current status for the certifications under preparation. Target dates appear here once formally committed with the auditor or notified body.
ISO 27001
Target date to be confirmed
ISO 13485
Target date to be confirmed
ICH E6(R3) GCP
Target date to be confirmed
FDA 21 CFR Part 11
Target date to be confirmed
EU MDR
Target date to be confirmed
For framework-specific questions, sub-processor due-diligence requests, or anything not covered above.
