Is REDCap 21 CFR Part 11 compliant? What sponsors need to verify

21 CFR Part 11 sets out the FDA's criteria for treating electronic records and electronic signatures as trustworthy and equivalent to paper. In practice, reviewers and inspectors look for a handful of things: a secure, computer-generated, time-stamped audit trail that records who changed what and when without hiding earlier values; electronic signatures that are unique to one person, linked to their record and carry a stated meaning; limited system access with authority checks; documented validation that the system does what it is meant to do; and written procedures and training for the people using it. The 21 CFR Part 11 compliance checklist lays these out requirement by requirement.

Notice that only some of those items are properties of software. An audit trail is a feature. Validation is an activity, documented by someone, against a defined intended use. Procedures and training belong to the organisation. That is why the phrase "shared responsibility" appears in every serious discussion of Part 11, and why a one-line yes or no on a web page is unreliable in either direction. We say the same about our own platform: Capture provides 21 CFR Part 11-aligned controls, and a sponsor still validates its use for its study. See 21 CFR Part 11 compliant EDC for how we describe that split.

REDCap is research data capture software developed within an academic consortium and, in the most common arrangement, installed and administered by a university or hospital for its own investigators. That has two consequences for a compliance question. First, the software is one input: the same version can be configured, patched and documented very differently at two institutions. Second, the hosting organisation, not the software's authors, usually holds the evidence you will need: server qualification, backup and recovery records, upgrade history, user provisioning and any validation work done on the local installation.

We therefore do not tell you that REDCap is, or is not, compliant. We cannot see your institution's installation, and a general statement would be wrong for someone. What we can say is that a sponsor, CRO or investigator using any institution-hosted system for regulated data should be able to put documented answers next to each element in the table above. If the institution has a research computing or quality group that supports clinical trials, start there. For the vendor's own position, read the current documentation published by the REDCap consortium rather than a third-party summary, including ours.

There are three realistic paths. The first is to close the gaps where you are: work with the hosting institution to document configuration, commission a validation exercise for your intended use and write the procedures. This can be the right choice for a single investigator-initiated study with a strong local research computing team, and it is why the REDCap true-cost worksheet asks you to price validation and staff time rather than assume they are free.

The second is to scope the tool to what it was chosen for: use an institutional research database for surveys, registries and non-regulated studies, and use a regulated system when data will support a submission or be inspected. That is a sensible division of labour and many institutions run both.

The third is to use a platform where the controls are built in and the vendor supplies documentation to support your validation. Capture's audit trail is field-level, written by database triggers and append-only, with each row hash-chained to the previous one; electronic signatures re-authenticate the signer and carry a meaning statement; roles and row-level security limit access; and enterprise customers get documentation to support sponsor validation and user acceptance testing. You still validate for your intended use, which is the point of shared responsibility. See the REDCap alternatives page for the comparison criteria and the Capture vs REDCap comparison for a side-by-side view.