Trial360 OS · TMF360

Trust & compliance

How TMF360 protects Trial Master File records, what is in place today and what is still in progress. We would rather tell you about a gap than have you find it.

Where we stand today

CDISC TMF Reference Model v3.3.1	Native file plan, completeness and exports	In place
eTMF Exchange Mechanism (EMS) v1.0.2	Export and import validated against the current official schema; transfers keep metadata, versions and audit events	In place
21 CFR Part 11 / EU Annex 11	Clause-by-clause matrices available under NDA	In place
Validation package	Validation plan, IQ/OQ/PQ protocol, automated IQ and OQ, traceability of every requirement; customer PQ in a pilot	In progress
SOC 2 / ISO 27001	Not yet held. Our hosting providers hold SOC 2 Type II reports	Not yet
Independent penetration test	Not yet performed	Not yet
Data residency	Hosted in the USA; dedicated EU deployment on the roadmap	In progress

Controls in the product

Audit trail

Written by the database for every change, with user, server time, old and new values and reason. Append-only and hash-chained; verified at every release.

Electronic signatures

Password re-check for every signature; user ID and password at the first signature of a session; meaning, signer and server time bound to the exact file version and its hash.

Access control

Personal accounts, row-level security on every table, access per study, site and TMF section, blinded records, two-factor sign-in, account lockout after failed passwords.

Data integrity

Every file stored once with a SHA-256 hash, never overwritten; new versions are new records; scheduled integrity re-checks.

Records retention

Retention policies and legal holds per study; records are never purged by the system; signed archive packages.

Inspection

Time-limited, read-only inspector sessions with an access code, download controls and a full activity log.

Releases

Every release passes automated unit, integration and end-to-end tests and an installation check on production; customers see each release's validation impact.

Hosting and subprocessors

All connections use TLS (TLS 1.3 negotiated) with HSTS. Data is encrypted at rest by the hosting provider.

Provider	Purpose	Location
Supabase	Database, authentication, file storage	USA (us-east-1)
Vercel	Application hosting	USA (iad1)
Resend	Transactional e-mail (no document content)	Provider-managed
Anthropic	AI assistance, only for capabilities an organisation switches on	Provider-managed
GitHub	Source code (no customer data)	Provider-managed

Request the evidence pack

Part 11 and Annex 11 matrices, standards alignment, validation plan and reports, traceability matrix, security architecture, release and exit procedures. Shared after a mutual NDA.

Name *Work e-mail *Company *Job titleWhat do you need?

What happens next: we e-mail you an NDA; once signed, the pack follows.

Service status: live health check