ISO 27001 clinical trial software your security team can review
Capture is ISO 27001 certified. This page explains what that certificate does and does not tell you about an EDC, and the controls to check in the product itself before you shortlist.
- ISO 27001 certified
- 21 CFR Part 11 compliant
- EU and US data hosting
Free sandbox · No credit card · 21 CFR Part 11 compliant
Certification
ISO 27001 certified
Hosting
EU (Frankfurt) or US (N. Virginia)
- Information security management system certified to ISO/IEC 27001:2022Certificate on request
- Field-level audit trail, append-onlyTrial-level control
- Role-based access with PII segregationTrial-level control
- Two-factor sign-in with an authenticator appStaff accounts
- Read the certificate scope against the system you will useYour reviewer
What an ISO 27001 buyer should know
- ISO/IEC 27001 certifies an information security management system (ISMS): how an organisation identifies risk, chooses controls and keeps improving them. It does not certify that a particular screen or feature is secure.
- Capture is ISO 27001 certified, to the 2022 edition of the standard. The certificate is available on request, and the request form is linked on this page.
- The certificate has a scope. Ask what it covers, which organisation and services it names and when it expires, then compare that with the product and hosting region you intend to use. This page does not state the scope for you.
- ISO 27001 does not replace 21 CFR Part 11 or ICH GCP controls such as the audit trail and electronic signatures. Those are checked in the system. Capture is also 21 CFR Part 11 compliant and ICH GCP E6(R3) compliant.
- SOC 2 is not claimed on this page. If your procurement form demands it specifically, ask us what we can offer instead of assuming.
The standard
What the certificate proves, and the questions it leaves open
ISO/IEC 27001 is a management-system standard. An independent certification body audits the organisation against it, issues a certificate for a stated scope, and returns for surveillance audits in the years that follow, with a full recertification cycle after three years. The 2022 edition groups the Annex A controls into four themes: organisational, people, physical and technological. In practice the certificate tells a sponsor that policies for access, supplier management, incident response, change control and similar topics exist, are applied, and are audited from outside.
What it does not tell you is how a clinical data system behaves. A certified organisation can still ship an EDC with weak audit trails. That is why a clinical security review needs two layers: the organisation-level assurance (the certificate, the data processing agreement, the hosting region) and the product-level controls that GCP inspectors actually test. Our vendor security questionnaire guide walks through the second layer line by line.
Read the certificate, not the logo
A badge on a website is a pointer, not evidence. Ask for the certificate itself and check four things: the legal entity named, the scope statement, the standard edition and the validity dates. If the scope does not mention the service you will use, that is a finding. We publish the badge; the certificate is available on request through the contact form.
Weight changed 68.0 to 68.5 kg
Site coordinator · Reason: Transcription error
Query Q-0014 answered on Weight
Site coordinator · Reason: Source checked
Vital signs form locked
Data manager · Reason: Visit cleaned
Two layers of assurance
Where ISO 27001 ends and trial-specific controls begin
Use this table to split a security questionnaire into what a certificate answers and what you must see in the product.
| Question from your reviewer | Answered by the certificate | Check in the system | Capture |
|---|---|---|---|
| Is there a managed information security programme? | Yes, that is the purpose of the ISMS | Not needed | ISO 27001 certified; certificate on request. |
| Who can see identifying participant data? | Only that access control is governed | Role matrix, PII segregation | Researcher, site coordinator and admin roles; coordinators see names, researchers see coded IDs; row-level security at the database. |
| Can a record be changed without a trace? | No, this is a product behaviour | Audit trail | Field-level trail with timestamp, user, old value, new value and reason; append-only. |
| How are users authenticated? | Policy level only | Sign-in options | Staff can turn on two-factor authentication with any authenticator app; sessions end after inactivity with a countdown warning. |
| Where is data stored and protected? | Hosting controls within scope | Region setting, encryption | EU (Frankfurt) or US (N. Virginia); AES-256 at rest, TLS in transit. |
| Are electronic signatures Part 11 grade? | No, this is a product behaviour | Signature workflow | Staff re-enter their password and see a meaning statement; the signature is hashed to the document. |
Hosting region is chosen when the study is set up. Whether the certificate scope names every component of the service is for your reviewer to confirm from the certificate.
Access control
The access controls an auditor will ask to see
Certification covers the policy that access is granted by role and reviewed. The product shows the result. Capture separates identifying information from study data at the database layer, so a researcher analysing data sees coded IDs while a site coordinator sees names for their own site.
- Researcher, site coordinator and admin roles with different views of the same participant.
- Row-level security in the database, not only in the interface.
- Blinded roles never receive treatment-arm values; this is enforced with masked database views.
- Clinical data is soft-deleted only; hard deletes are blocked.
Site coordinator
Jane Peterson
DOB: 04-Mar-1978
Subject 01-004
Sees direct identifiersResearcher
Subject 01-004
DOB: withheld
Coded ID only
Sees coded ID onlySame record, two roles. Row-level security enforces the split.
Put the controls in front of your reviewer
Open the free sandbox, create a role per reviewer and let them test access, the audit trail and sign-in themselves. No credit card, no time limit.
Integrity
An audit trail that the database writes, not the interface
ISO 27001 expects integrity controls on information. For trial data the concrete form is the audit trail. Capture writes one row per changed field through database triggers. Rows cannot be updated or deleted, and each carries a SHA-256 hash chained to the previous row for the study, so an after-the-fact edit shows up as a broken chain.
- Who, when, old value, new value and reason for change, on every record.
- Repeating rows such as concomitant medications carry their own trail.
- The trail is always exportable for sponsors and inspectors.
Weight changed 68.0 to 68.5 kg
Site coordinator · Reason: Transcription error
Query Q-0014 answered on Weight
Site coordinator · Reason: Source checked
Vital signs form locked
Data manager · Reason: Visit cleaned
Run the review
A four-step ISO 27001 vendor review for an EDC
- 1
Request the certificate
Use the document request link. Check entity, scope, edition and dates against the service you will actually buy.
- 2
Request the supporting documents
Ask for the data processing agreement (GDPR) and, if you handle US protected health information, the business associate agreement. Both are available on request.
- 3
Test the controls
In the sandbox, create roles, change a value, read the audit trail, turn on two-factor sign-in and sign a form. Reviewers believe what they can click.
- 4
File the evidence
Record the certificate, the questionnaire answers and your sandbox findings in the vendor qualification file, then repeat the check at each certificate renewal.
Procurement checklist
What to put in the vendor file
Certificate and scope
Request it, read the scope and expiry, and note the surveillance schedule you will check next year.
Part 11 evidence
Ask for the validation package, which is available on request, and map it to your own validation plan. See the 21 CFR Part 11 compliant EDC page.
Privacy documents
Data processing agreement for GDPR, BAA for HIPAA, and the hosting region chosen for each study.
Sign-in controls
Read multi-factor authentication in EDC and decide who in your team must turn it on.
Exit and retention
Confirm export formats (CSV/Excel with data dictionary, SDTM as SAS XPT with Define-XML) before you need them.
Is Capture ISO 27001 certified?
Yes. Capture is ISO 27001 certified, with an information security management system certified to ISO/IEC 27001:2022. The certificate is available on request through the contact form.
Does ISO 27001 mean the EDC is validated for GCP?
No. ISO 27001 certifies an organisation's security management system. Validation, the audit trail and electronic signatures are product controls that you assess separately. Capture is also 21 CFR Part 11 compliant and ICH GCP E6(R3) compliant, with a validation package available on request.
What does the certificate scope cover?
Ask for the certificate and read the scope statement on it. This page does not describe the scope, because the certificate itself is the authoritative source for the entity, services and dates.
Is Capture SOC 2 certified?
This page does not claim SOC 2. If your procurement team requires it, tell us what they need and we will say what we can provide.
Do I need ISO 27001 to run a clinical trial?
No law requires a vendor to hold it. Many sponsors and hospitals ask for it as part of vendor qualification because it is independent evidence of a security programme. It complements, not replaces, trial-specific controls.
Where is my data stored?
In the EU (Frankfurt) or the USA (N. Virginia), as chosen when the study is set up. Data is encrypted with AES-256 at rest and TLS in transit.
Can my security team test before we sign anything?
Yes. The free sandbox has the same controls as a live study, with no credit card and no time limit. You pay only when you go live with real participants.
Keep exploring
Related pages
Vendor security questionnaire for clinical trial software
The product-level questions to ask.
Multi-factor authentication in EDC
Sign-in controls in detail.
Role-based access control in clinical trials
Who sees what.
Audit trail software for clinical trials
The Part 11 evidence trail.
21 CFR Part 11 compliant EDC
Controls an inspector tests.
GDPR compliant clinical trial software
Processor agreement and hosting.
Security overview
All six compliance badges explained.
Review the controls yourself, free
Build a study, invite your reviewer and test access, audit trail and sign-in before any fee.