Everything procurement, security, and compliance teams need to evaluate Vitruvian Shield, in one place.
Status against the frameworks relevant to clinical research software in our target markets, stated as designed to, designed for, in progress or targeted.
The platform is designed to ALCOA++ data-integrity principles; every record is attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring and available, and exposed through the audit trail. ALCOA++ is a set of principles, not a certification.
Designed to GDPR requirements, with a Data Protection Impact Assessment per study, an Article 28 data processing agreement, and EU hosting by default.
Platform architecture is designed for HIPAA Administrative, Physical, and Technical Safeguards alignment, including minimum-necessary access, protected health information de-identification pathways, and comprehensive audit logging.
An information security management system programme is in progress at the application layer; the certification date will be published when fixed.
A quality management system programme for medical device software is in progress with an external certification partner; no certificate has been issued to date.
The architecture is designed for ICH E6(R3), including Annex 2 on decentralised elements, which takes effect in the European Union on 15 January 2027. The validation dossier is planned.
Electronic records and audit trails designed for 21 CFR Part 11; formal validation is planned.
The platform is positioned as software as a medical device under EU MDR 2017/745, with CE marking targeted for 2028 through a notified body. No certificate has been issued to date.
Every document below is available on request through the inline form. Requests are reviewed within two business days.
Template drafted to GDPR Article 28 for use between Vitruvian Shield and customer controllers.
Data Protection Impact Assessment template prefilled with platform-specific data flows and risk categorisation.
Outline of the planned computer system validation approach for electronic records, audit trails, electronic signatures and the open-system controls of a SaaS platform; formal validation is planned.
Detailed specification of the immutable audit trail, event taxonomy, retention policy, and customer-export endpoints.
Pre-filled vendor security questionnaire covering organisational security, access control, cryptography, incident response, business continuity, and sub-processor management.
Third parties processing data on behalf of Vitruvian Shield, with their purpose, processing location and their own security certifications.
Microsoft Azure (Microsoft Corporation)
Thryve (mHealth Pioneers GmbH)
Vercel Inc.
Resend (Drift Net Inc.)
Google Analytics (Google LLC)
| Sub-processor | Purpose | Processing locations | Certifications |
|---|---|---|---|
| Microsoft Azure (Microsoft Corporation) | Clinical platform hosting and data storage, West Europe region; EU hosting by default | EU | Supplier's own: ISO 27001, SOC 2 Type II |
| Thryve (mHealth Pioneers GmbH) | Wearable data aggregation, engaged per study when a study uses devices activated through Thryve | EU | Supplier documentation on request |
| Vercel Inc. | Web application hosting (marketing site) and edge delivery | USEU | SOC 2 Type II, ISO 27001 |
| Resend (Drift Net Inc.) | Transactional email delivery for marketing forms | US | SOC 2 Type II |
| Google Analytics (Google LLC) | Website traffic analytics, where enabled. No clinical platform data. | USEU | ISO 27001, ISO 27017, ISO 27018 |
Sub-processor changes are notified to customers in advance. Clinical platform data is hosted in the EU by default; ask about regional residency options at procurement time.
How Vitruvian Shield protects clinical data and platform access.
Access to platform data follows least-privilege principles. Every customer-side action is authenticated, authorised against a role and project scope, and recorded in an immutable audit trail. Administrative access to production systems is restricted to a named operations team, gated by multi-factor authentication and logged independently.
Clinical data is encrypted at rest with AES-256 and in transit with TLS 1.2 or above, with HSTS enabled. Encryption keys are managed by the cloud provider's key management service and rotated on the provider's schedule, with operator access policies enforced at the key layer rather than the application layer.
Application dependencies are tracked in a continuously updated Software Bill of Materials. Security advisories against direct and transitive dependencies are triaged within one business day for critical vulnerabilities, with patches applied through the standard release pipeline. The SBOM is available to customers on request via the Document Library.
Incident response follows a documented runbook covering detection, triage, containment, eradication, recovery and post-incident review. As a processor, Vitruvian Shield notifies the affected customer (the controller) without undue delay after becoming aware of a personal data breach; the controller notifies the supervisory authority within 72 hours where GDPR Article 33 requires it.
Independent penetration testing is scheduled, and a published path lets security researchers report issues responsibly.
Scheduled
External web application and API surface, with grey-box methodology against the staging environment.
Security researchers who believe they have found a vulnerability in Vitruvian Shield are encouraged to report it through the contact below. Reports are acknowledged within 72 hours and triaged within five business days. We do not pursue legal action against researchers who follow our disclosure policy.
Target sequence and current status for the certifications under preparation. Target dates appear here once formally committed with the auditor or notified body.
ISO 27001
Target date to be confirmed
ISO 13485
Target date to be confirmed
ICH E6(R3) GCP
Target date to be confirmed
FDA 21 CFR Part 11
Target date to be confirmed
EU MDR
2028
For framework-specific questions, sub-processor due-diligence requests, or anything not covered above.
