Security & Compliance

Honest about what we have today, what is coming, and what we do not do. Compliance investments scale with customer demand.

What we have today

✓Encrypted connections between your browser and ConductCompliance (HTTPS with TLS 1.2 or 1.3)
✓Anthropic, our AI provider, doesn't train on your data
✓Passwordless sign-in: a one-time link we email you, which expires in 15 minutes
✓Per-user audit log

Where your data goes

The app runs on Vercel. Study records and uploaded files are kept in a database on a dedicated server we operate. Resend sends sign-in links and account email, and Anthropic drafts the rationale packet when you ask for one.

Patient data (PHI)

The cloud edition isn't built for PHI. Keep patient information out of uploads and free-text fields (the forms remind you), or use the offline edition, which keeps data on your own network.

What is coming (customer-triggered)

Each layer activates when customer demand justifies the spend. We do not invest speculatively.

→21 CFR Part 11 e-signatures, for FDA-regulated trial customers
→SOC 2, ISO 27001, HITRUST and FedRAMP, on customer demand

What we do not do

✗Sell or train on customer data
✗Hide our compliance posture
✗Replace your IRB office
✗Approve protocols ourselves

Run it on your own servers

ConductCompliance also runs offline, installed on your own network. Records stay on your servers. People sign in with your organization's accounts, from your identity provider, and your IT team controls updates and backups. See how offline works.

ConductCompliance is software for preparing IRB submissions, not an IRB itself. PIs use ConductCompliance to draft their IRB application, HIPAA waiver, consent forms, and protocol document. They then submit to whichever IRB their study actually uses (their university IRB, a commercial IRB like WCG or Advarra, or a single IRB of record for a multi-site study). IRB offices can also run their review in it. Your IRB has final authority.