Security & Data Practices
This page summarizes how TrialCurrent handles customer data and the controls currently used to protect it. Customers may use it as a starting point for vendor and security reviews.
No patient data, by design
TrialCurrent supports the sales and operations work performed by clinical research organizations, including opportunities, sponsor and site relationships, protocol documents, feasibility, vendor coordination, and study-startup tracking.
What we store
Your workspace holds the business records your team creates:
- Sales records: opportunities, accounts, activities, notes, and forecasts your team enters.
- Professional contact details: names, titles, work email addresses, and work telephone numbers for sponsor, site, CRO, and vendor personnel. When AI identifies an unfamiliar name in notes, it presents the name for user review rather than automatically creating a contact.
- Documents you upload: protocols, CDAs, MSAs and award letters, versioned, categorized, and stored per workspace.
- Site feasibility responses submitted by sites through secure links (operational answers: interest, capacity, capabilities, timelines).
- User accounts and roles, and standard usage logs.
Discover uses public business sources such as trial registries, company announcements, job postings, and government filings. Results link to supporting sources. Discover does not initiate contact with companies or individuals.
Where it runs
TrialCurrent uses Vercel for application hosting and Supabase for its PostgreSQL database and file storage. Both providers maintain independent security and compliance programs. Connections are encrypted in transit, and the infrastructure providers encrypt stored customer data at rest. The database provider performs scheduled backups under the applicable service plan.
Production access is limited to the minimum number of authorized people. At present, administrative production access is restricted to one authorized administrator. Administrative accounts for source control, hosting, and the database use multi-factor authentication, and shared administrative credentials are not permitted.
How your data is isolated
- Each record is associated with a Customer organization, and organization-level access checks are applied on the server for reads and writes. Tenant separation does not depend on interface filters alone.
- External questionnaire participants do not receive general workspace access. They receive a unique, time-limited link scoped to the requested response. Expired or cancelled links no longer accept submissions.
- Users review and approve feasibility outreach before it is sent. Messages are transmitted through the Customer's connected mailbox; TrialCurrent does not independently initiate external outreach.
Access control
- TrialCurrent currently provides Admin, Sales User, and View Only roles. Permission checks are enforced on the server, not only through visible interface controls.
- Deletion rights depend on role and record type. Admins have broader rights, while standard users have limited deletion rights for specified records. Current permissions are reviewed with the Customer during implementation.
AI and your data
AI supports defined extraction, drafting, and matching tasks. It does not approve business decisions or send outreach without a user's review.
| AI behavior | How it works in TrialCurrent |
|---|---|
| User review | AI can extract fields, draft outreach, and suggest vendor requirements. A user reviews the result before it becomes an approved record or external message. |
| Existing information | AI fills empty fields where appropriate. If a document conflicts with information entered by a user, TrialCurrent flags the difference for review. |
| Approved values | Generated tags and matched values use defined taxonomies. Values outside those taxonomies are flagged for review. |
| Ambiguous sources | When source information is unclear, TrialCurrent leaves the field unresolved or requests clarification rather than inventing a value. |
| Forecast controls | Stage gates, probability calculations, and management metrics use defined rules and stored records. AI-generated text does not directly change the forecast. |
Customer workspace data remains under the Customer's control. When a user invokes an AI-assisted feature, limited content is processed through Anthropic's commercial API. Anthropic does not use commercial API inputs or outputs for generative-model training unless the account holder expressly opts in; TrialCurrent does not opt in on a Customer's behalf.
Auditability
- Selected pipeline-stage changes require supporting information. An authorized override requires a reason and is recorded with the user and timestamp.
- Win probability is calculated from defined inputs that users can review. A manual override requires a reason and expires after 14 days.
- System-created records identify their creator, audit fields are read-only in the interface, and document re-uploads are maintained as versions rather than unrelated copies.
A fuller control-by-control walkthrough for IT, security, quality, and procurement teams is on the Trust & Governance page.
Independent certifications
TrialCurrent does not currently hold its own SOC 2 or ISO 27001 certification. Vercel and Supabase maintain their own independent certifications and reports for their infrastructure services. TrialCurrent supports reasonable Customer security reviews through questionnaires, documentation, and technical walkthroughs under appropriate confidentiality terms.
Privacy and data rights
A Data Processing Agreement is available for Customers that require one. After service termination, Customer workspace data is available for export on request and deleted from active systems within 30 days unless law requires retention or the parties agree otherwise. See the Privacy Policy for how we handle personal information as a controller.
Subprocessors
| Provider | Purpose |
|---|---|
| Vercel | Application hosting |
| Supabase | Database, authentication, and file storage |
| Anthropic | User-invoked AI extraction and drafting through commercial API services |
Responsible disclosure
To report a suspected vulnerability, email security@trialcurrent.com. We review good-faith reports and prioritize issues based on severity and potential impact.
FAQ
Does TrialCurrent store patient data?
No. TrialCurrent supports clinical research sales and operations. It is not designed for patient health information, subject identifiers, medical records, or ePHI.
Can other TrialCurrent customers see our data?
Customer records are separated by organization-level access checks enforced on the server for reads and writes.
Is our data used to train AI models?
No. TrialCurrent does not opt Customer content into model training. Anthropic's commercial API does not use inputs or outputs for generative-model training unless the account holder expressly opts in.
Do sites need accounts to answer feasibility questionnaires?
No. Each site receives a unique, time-limited link scoped to its questionnaire response and does not receive general access to the Customer workspace.
Are you SOC 2 / ISO 27001 certified?
No. TrialCurrent does not currently hold its own SOC 2 or ISO 27001 certification. Its infrastructure providers maintain independent compliance programs, and TrialCurrent supports Customer security reviews directly.
Who at TrialCurrent can access our data?
Administrative production access is currently restricted to one authorized administrator. Administrative accounts use multi-factor authentication, and shared administrative credentials are not permitted.
How is our data backed up?
The database provider performs scheduled backups under the applicable service plan. Backup restoration and retention depend on the configured provider plan and are reviewed as part of technical diligence.
What happens to our data if we leave?
Customer workspace data is available for export on request and deleted from active systems within 30 days after service termination, subject to legal retention requirements and ordinary backup rotation.
How is TrialCurrent priced?
TrialCurrent is priced per site. The per-site rate may be adjusted based on the Customer's business type, operating model, volume, and contracted scope. The applicable rate and terms are stated in the Customer's Order Form.