The licence is free to consortium members. The system owner role is not: someone has to host, patch, validate and document REDCap for regulated use. Here is what that involves and who usually carries it.
Free sandbox · No credit card · 21 CFR Part 11 aligned
weeks
The short answer
Who is the system owner
Commercial EDC vendors host the system, hold the validated state and supply validation documentation, and then you perform your own user acceptance testing. REDCap inverts this. The consortium distributes the software and its documentation, and a partner institution installs it on its own servers. That institution becomes the system owner: it decides when to upgrade, runs the infrastructure, controls access and, if the instance supports regulated studies, validates it.
This is a perfectly workable model and many universities do it well. The point of this page is that the effort lands somewhere, and a study team choosing REDCap should know where. If a central service already exists, your cost is mainly local project validation and training. If you are standing up an instance for one group, you are taking on a small IT operation.
For the 21 CFR Part 11 side of the same question see is REDCap 21 CFR Part 11 compliant?; for data protection see is REDCap GDPR compliant?. For a money view, see REDCap true cost vs EDC, and for options, REDCap alternatives.
The recurring work
A planning inventory built from public institutional SOPs and papers read on 13 October 2026. Your quality unit decides what is required.
| Activity | REDCap: typical owner | Capture |
|---|---|---|
| Hosting and infrastructure | Hosting institution: servers, backups, monitoring, security patches | Managed hosting in the EU (Frankfurt) or the USA (N. Virginia) |
| Release review | Local team reviews each version's change log and requirements specification | Platform releases are ours; enterprise customers receive documentation to support sponsor validation |
| Re-validation per upgrade | Local team; sites often choose LTS versions and delay after release for testing | Your UAT of your own study build |
| External modules | Administrators assess, approve and test each module; Vanderbilt disclaims risk | No third-party module layer to assess |
| Project-level validation | Study team validates each project at build and after changes, per local SOP | Test your build in the free sandbox; draft to approved lifecycle locks live forms |
| Access reviews and training | Institution and study team | Study team; role-based access |
| Audit trail and e-signature configuration | Institution configures, study team verifies | Field-level, append-only, hash-chained audit trail; re-authenticated signatures |
| Support | Institution's REDCap team and consortium community | Email support, typically under 24 hours; setup guides and tutorials |
Capture does not remove your responsibility: Part 11 is shared and your UAT is yours. It moves hosting and release work to us.
Project-level testing
Even on a managed platform you test your own study. The difference is that you test the build, not the infrastructure. A typical sponsor UAT covers data entry, edit checks, queries, signatures, roles and exports against a protocol-based script. In the Capture sandbox you can run that script with every feature available, before paying anything.
Executed
7 of 10
Every feature in the free sandbox, no credit card. Read the evidence you will need for your validation file.
Decision
Carry it when your institution already runs a validated service with dedicated staff, your studies are investigator-initiated, collaborators are inside your network and the marginal cost to you is project validation. You gain governance, familiarity and often a free licence.
Reconsider when you would be building the capability yourself, when a sponsor wants vendor-supplied validation evidence, when a funder's timeline cannot absorb a host's upgrade schedule, or when the study needs consent, ePRO and randomization together. See computer system validation for clinical trial software and EDC UAT sandbox environments for what a vendor-supplied path looks like, and Annex 11 vs 21 CFR Part 11 for how the two frameworks frame the system-owner role.
Whichever you choose, write down who the system owner is, who validates, and when. The most common finding is not a missing feature but a missing owner.
Decision checklist
Find the person and the SOP that gives them authority.
Standard or LTS, and the date it was last validated.
Requirements, test scripts, executed evidence and summary report.
Who approved each one, and was it tested after the last upgrade?
Downtime, project checks, and sponsor notification.
Verify them yourself; see audit trail software.
Tested restore, not just a schedule.
Frequency and evidence.
Who answers when a site cannot log in?
Export data, dictionary and audit logs; archive with the study.
Per a 2026 consortium paper we found, each hosting institution acts as system owner and validates its local environment. Vanderbilt provides the software, a change log and requirements documentation but not pre-validated hosting.
It depends on your SOP and the releases you adopt. REDCap has monthly standard releases and a semi-annual LTS release per institutional accounts, and some regulated sites choose LTS versions and validate each one.
It varies widely. Published institutional accounts range from shared rapid-validation approaches to months of initial effort and about 1,000 pages of documentation. Treat these as examples, not benchmarks.
Per Vanderbilt's disclaimer, risk for a module in your installation is borne by the administrators who install it, so your host must assess and test it. Ask which modules are installed.
The software is free to consortium members, but hosting, support, validation and training are real work for someone. See the true cost page for a fuller view.
Hosting, patching and platform releases. You still run UAT on your own build and Part 11 remains a shared responsibility. Enterprise customers receive documentation to support sponsor validation and UAT.
Rebuild forms with AI drafting from a described form or an uploaded data dictionary, review them and test in the sandbox. We do not claim automated project or data import.
Open the free sandbox, with every feature and no credit card. You pay only when you go live.
Keep exploring
Free sandbox, every feature. Run your UAT script and read the audit trail. No credit card.