No source,no action.

Audit trail, signature binding, access control and validation came first, not later. We build to these standards and ship their controls; we do not hold certifications against them.

Request the documents Part 11, clause by clause

Three laws

Three laws the platformenforces on itself.

Cite the clause, or produce a gap.

A form, a check, a query: each carries the protocol clause that authorized it. An ambiguous clause becomes a labelled gap for a person, never a confident guess.

Generated from protocol v4.0 RULE-0341Systolic BP 60–200 mmHg §6.2.1 CRF-0112Vital signs, 9 fields §6.2 GAP-0007Creatinine above 1.5, no unit given waits for a person

The model never runs the study.

An approved rule compiles to deterministic, versioned code. Re-run the study next year and it produces what it produced today.

Run · Oct 2026214 valuesRULE-0341 v17c1e…a90
=
Re-run · Oct 2027214 valuesRULE-0341 v17c1e…a90

Identical output

Nothing goes live on the model’s say-so.

A qualified person applies the change. That act, not the generation before it, is the authorizing event written to the record.

  1. Modelsuggested the rule
  2. Data managerreviewed it
  3. Data managerapplied it, e-signed
  4. Systemactivated RULE-0341 v1

The record

Every EDC has an audit trail.This one is chained.

Change one entry and watch what stops linking.

Audit trail · Form DM · Subject 0142Specimen

Chain verified. Every entry links to the one before it.

Entry 02 no longer matches its hash. 03 to 05 stop linking: detectable, not merely unlikely.

AccuraTrials audit trail listing timestamped, attributed entries for every action
21 CFR 11.10(e)
AccuraTrials electronic signature dialog requiring credential re-authentication, a signature meaning and a legal certification
21 CFR 11.200

Four regimes

Four regimes,and what we ship for each.

A sponsor demonstrates compliance. A vendor can hand over the machinery, so that is what this lists.

FDA · Electronic records and signatures

21 CFR Part 11

Designed inside from the first commit. Signatures re-authenticate and bind to the exact record version.

Part 11, section by section
  • §11.10(e)Hash-chained, tamper-evident audit trail
  • §11.70Signature bound to the record version
  • §11.200Credentials re-entered per signature

ICH · Good clinical practice

ICH E6(R3) GCP

R3 asks for quality by design. A study built from the protocol model, rather than configured per system, is that idea as software.

  • LifecycleThe subject lifecycle is traceable end to end
  • ChangeAn amendment is a versioned change to the model

HHS · Protected health information

HIPAA

PHI is designated at the form level, so the system knows which values are protected and enforces it.

  • DesignationPHI marked per form, not by convention
  • AccessScoped by role and by site
  • AuditEvery PHI access event recorded

EU · Data subject rights

GDPR

Every access is logged, so answering a data subject request is a query, not an investigation.

  • RetentionConfigurable per study, not globally
  • AccessEvery access in the audit trail

The line

What is validated,and what is only aligned.

Validated

Tested on every build

  • Audit-trail chain integrity
  • E-signature record binding
  • Permission enforcement
  • Data-lock immutability

A regression in any one of them fails the build.

Aligned

Built to the shape, not certified

SOC 2
Built to the trust principles. No completed audit is claimed.
ISO 27001
An ISMS run as a system. Aligned, not certified.
Yours

Your qualification, our evidence

  • Test evidence
  • Validation approach
  • Security summary

A sponsor demonstrates compliance for the system as used. We hand over what that requires.

Ask us the hardcompliance questions.

Thirty minutes with our team. Validation approach, compliance posture and security summary on request.

OPEN THE EDC Request the documents

Or email us: jgui@accuratrials.com