Germany runs more clinical trials than almost any other European country, with strict expectations on data protection. Capture runs German sites in the same study as the rest of your programme, hosted in Frankfurt.
Free sandbox · No credit card · 21 CFR Part 11 aligned
Study region
Germany
Key points for studies in Germany
Research landscape
German sites, data protection officers and ethics committees look carefully at what data is collected, where it is stored and who can see it. Questions about hosting location, sub-processors, pseudonymisation and access rights come up early and often. Studies that can answer them clearly start faster.
Capture hosts study data in Frankfurt when EU hosting is chosen, separates identifying information from study data, and gives sponsor-side users coded participant IDs. Row-level security enforces site separation at the database layer, and every change is in the field-level audit trail. See role-based access control for clinical trials.
Coded participant data is still personal data under the GDPR, because the site holds the key. Document the pseudonymisation approach, who holds the key and who can access identifying data in your data protection documentation.
EU (Frankfurt)
Default for EU-sponsored studies
US (N. Virginia)
Default for US-sponsored studies
Controls
Hosting region chosen at setup, AES-256 encryption at rest and TLS in transit, identifying data segregated from study data, and roles that limit what each person sees. Electronic signatures require re-authentication, and the audit trail records who, when and why for every change.
Site coordinator
Jane Peterson
DOB: 04-Mar-1978
Subject 01-004
Sees direct identifiersResearcher
Subject 01-004
DOB: withheld
Coded ID only
Sees coded ID onlySame record, two roles. Row-level security enforces the split.
Open the same participant as a coordinator and a sponsor user in the free sandbox.
Working with sites
German university hospitals usually require a data processing agreement with each vendor that handles personal data, and their data protection officers often ask for a description of technical and organisational measures. Having those answers ready shortens contract negotiations considerably.
For Capture, the core measures are hosting in Frankfurt when EU hosting is chosen, AES-256 encryption at rest, TLS in transit, role-based access with site separation, identifying data segregated from study data, and a field-level audit trail. Put them in your data protection documentation and share them with sites early. See the vendor security questionnaire guide.
Before you start
BfArM or PEI for your product.
Including the German part and ethics review.
Pseudonymisation, key holder, hosting and sub-processors.
Including data processing agreements.
Approved consent and participant documents.
Ethics approval, contract, initiation visit and delegation log.
Usually yes, with each vendor that processes personal data on the study's behalf.
EU hosting in Frankfurt, AES-256 encryption at rest, TLS in transit, role-based access with site separation and a field-level audit trail.
The BfArM, or the Paul-Ehrlich-Institut for vaccines, blood products, antibodies and advanced therapies, together with registered ethics committees.
No. Pseudonymised data is still personal data because the key exists. Document who holds it.
Capture's EU hosting is in Frankfurt, chosen at study setup.
A German law passed in 2024 intended to speed up and simplify approvals for clinical research. Check how its provisions apply to your study.
Capture hosts study data in the EU (Frankfurt) or the US (N. Virginia), chosen at study setup, with AES-256 encryption at rest and TLS in transit. Choosing Frankfurt keeps study data in the EU.
Yes. The free sandbox has every feature with no credit card and no time limit.
Keep exploring