Multi-factor authentication for your EDC, with any authenticator app
Capture staff can turn on two-factor sign-in with an authenticator app and a six-digit code. This page shows what that covers, what it does not, and how to test it before you shortlist.
- Authenticator-app 2FA
- Inactivity sign-out with countdown
- Free sandbox
Free sandbox · No credit card · 21 CFR Part 11 compliant
Enter email and password
First factor: something you know
Open your authenticator app
Any app that generates time-based codes
- 3
Enter the six-digit code
Second factor: something on your device
- 4
Work in the study
Session ends after inactivity, with a warning first
What to know before you ask a vendor about MFA
- Capture supports two-factor authentication with any authenticator app. The second factor is a six-digit time-based code generated on the user's own device.
- It is a staff sign-in feature. Participants reach their questionnaires and consent through study links, not staff accounts.
- This page claims authenticator-app codes only. SMS codes, hardware security keys and single sign-on are not part of what we describe here.
- Sessions end after a period of inactivity, with a countdown warning first. That limits the damage from an unattended laptop in a clinic.
- Two-factor sign-in is one control among several. Role-based access, the audit trail and password re-entry on signature are what finish the Part 11 picture.
Why it matters
A stolen password should not be enough to edit trial data
An EDC holds health data and the records a regulator relies on. Passwords leak, get reused and get phished. A second factor means that someone who holds the password still needs the code from the user's device before they can sign in, change a value or sign a form.
For a sponsor the concern is practical. Site staff move between shared clinic machines and personal phones, monitors log in remotely, and data managers work from home. Two-factor sign-in is the cheapest control that closes the most common account-takeover route. FDA's 21 CFR Part 11 asks, in general terms, that system access be limited to authorised individuals and that identification code and password controls be maintained; many sponsors read that as supporting multi-factor sign-in without it being named. Read the rule text with your QA team rather than treating this page as an interpretation.
Why authenticator apps, not text messages
Codes sent by SMS depend on a phone number that can be hijacked by a SIM swap, and they arrive over a channel the sponsor does not control. Time-based codes (the TOTP method in RFC 6238) are generated on the device and never travel over the phone network. Security guidance such as NIST's digital identity guidelines treats SMS as a weaker option for this reason; check the current text if your policy cites it. Capture uses the authenticator-app method.
- SO
Study owner
Builds and configures the study
- PI
Principal investigator
Oversees the site, signs off the casebook
- SI
Sub-investigator
Enters and signs clinical data
- SC
Study coordinator
Screens subjects, enters visit data
- CRA
Monitor (CRA)
Verifies data, raises queries
- DM
Data manager
Reviews, freezes and locks data
- PT
Participant
Completes their own questionnaires
Sign-in controls in the stack
What each control protects, and where MFA fits
| Control | Stops | Needs the user to | Capture |
|---|---|---|---|
| Password | Casual access | Know a secret | Required for every staff account. |
| Authenticator-app code | Stolen or guessed passwords | Hold a registered device | Staff can turn on two-factor authentication with any authenticator app. |
| Inactivity sign-out | Unattended sessions | Do nothing | Sessions end after inactivity, with a countdown warning first. |
| Role-based access | Seeing more than the role needs | Be assigned a role | Researcher, site coordinator and admin roles; PII segregation; row-level security. |
| Password re-entry on signature | Signing as someone else | Re-authenticate | Investigators and staff re-enter their password and see a meaning statement. |
| Audit trail | Undetected changes | Nothing; it records | Field-level, append-only, with user, time, old and new value and reason. |
Whether your organisation requires every user to turn on two-factor sign-in is a policy decision for your quality system. This page does not describe an administrator-enforced setting.
Try the sign-in flow with your own authenticator app
Create a free sandbox account, turn on two-factor sign-in and see what your site staff will see.
After sign-in
Sessions that end when people walk away
Two-factor sign-in protects the front door. Inactivity sign-out protects the open door: after a period of no activity the session ends, and the user sees a countdown warning first so that a long form is not lost without notice. Together with role-based access this keeps a shared clinic workstation from becoming an audit finding.
- Warning before sign-out, so a clinician mid-entry can continue.
- Each person has their own account; shared logins are not needed.
- Every change they make carries their identity in the audit trail.
Meaning of signature
I have reviewed this adverse event and confirm the assessment of seriousness, severity and causality.
Signer
Dr. A. Ozola, PI
Password
••••••••••
Roll it out
Turning on two-factor sign-in for a study team
- 1
Pick an authenticator app
Any app that produces six-digit time-based codes works. Choose one your IT team already approves.
- 2
Set it up per user
Each staff member turns on two-factor sign-in on their own account and registers their device.
- 3
Write it into the plan
Record in your access management procedure who must use it and what happens when a phone is lost. Ask us how account recovery works before you rely on it.
- 4
Train and test
Run a site training in the sandbox, including a lost-device drill. Keep the training record in the trial master file.
Questions to ask any EDC vendor
An MFA checklist for vendor qualification
Which second factors are offered?
Capture: authenticator app. Ask every vendor to list SMS, email codes, hardware keys and single sign-on separately so you can compare like with like.
Who can turn it on?
Staff can turn it on for their own account. Ask whether your policy needs an administrator-enforced setting and what the vendor offers.
What happens on a lost device?
Ask for the recovery procedure in writing and test it in the sandbox. This page does not describe recovery steps.
Does it cover signatures?
Signatures need password re-entry and a meaning statement. See 21 CFR Part 11 compliant EDC.
Is access reviewed?
Pair MFA with a periodic user list review. See role-based access control.
Does Capture support multi-factor authentication?
Staff can turn on two-factor authentication with any authenticator app, using six-digit time-based codes.
Does Capture support SMS codes, hardware keys or SSO?
This page describes authenticator-app codes only. It does not claim SMS, hardware security keys or single sign-on.
Can I make two-factor sign-in mandatory for everyone?
Staff can turn it on for their own accounts. This page does not claim an administrator-enforced policy, so ask us about your exact requirement before you write it into a procedure.
Do participants need an authenticator app?
No. Two-factor sign-in is for staff accounts. Participants reach questionnaires and consent through study links.
Is MFA required by 21 CFR Part 11?
Part 11 asks for limited system access, controls on identification codes and passwords, and signature controls. It does not name multi-factor authentication. Many sponsors still require it. Capture is 21 CFR Part 11 compliant, with a validation package available on request.
What happens if a user loses the phone with the app?
Ask us for the recovery procedure and test it in the sandbox. This page does not describe it, and your access management procedure should record it.
Can I test it before buying?
Yes. The free sandbox has the same sign-in controls, with no credit card and no time limit. You pay only when you go live.
Keep exploring
Related pages
ISO 27001 clinical trial software
What the certificate covers.
Role-based access control in clinical trials
Who sees what.
21 CFR Part 11 compliant EDC
Controls an inspector tests.
Electronic signatures for clinical trials
Signature workflow.
Vendor security questionnaire
Questions to put to any vendor.
Audit trail software for clinical trials
Every change attributed.
Security overview
Compliance badges and controls.
See two-factor sign-in before you shortlist
Turn it on in the free sandbox with your own authenticator app and show your QA team.