REDCap has no vendor to call: what that means when an inspector asks
REDCap is widely trusted in academic research, but support runs through your own institution rather than a commercial vendor. A neutral look at what that changes for an inspection, a sponsor audit or a regulated trial.
- Neutral, no pricing claims
- Questions to document
- Free sandbox to compare
Free sandbox · No credit card · 21 CFR Part 11 compliant
| Question | Self-hosted REDCap | Commercial EDC | |
|---|---|---|---|
| Validation evidence | Your institution or study team | Vendor package, then your use | |
| System audit by sponsor | Your institution's REDCap team | Vendor and your team | |
| Upgrade impact | Local team decides timing | Vendor release notes | |
| Incident response | Local IT and REDCap team | Vendor and you |
The short version
- "No vendor support" is partly true and partly a framing. REDCap was built at Vanderbilt University and is shared with partner institutions through the REDCap Consortium. The partner institution typically installs, hosts and supports it locally, and the consortium provides documentation and a community. Check the current terms with the consortium.
- For routine academic research, a local REDCap team is a strength: researchers get hands-on help. The risk appears when a regulator, sponsor or auditor asks someone to stand behind the system.
- The questions an inspector tends to ask are about validation, change control, access and audit trail. In a self-hosted setup, the answers come from your institution, not a vendor. Whether they exist, and are documented, is the real risk.
- This page makes no claim about REDCap pricing, features beyond public documentation, or any institution's quality of service. Sources also differ on whether the software alone meets Part 11; see our separate page on that question.
- It is not a reason to leave REDCap. It is a reason to write down your answers now.
The support model
How REDCap support is usually organised
Commercial EDC systems have a vendor with a validation team, release notes, a quality system and an account manager. When a sponsor audits the vendor, or an inspector asks about a bug fix, there is a single organisation to ask. REDCap is different by design. A partner institution installs the software on its own servers or a cloud account it manages, and its local team supports users, applies upgrades and handles outages. The consortium of institutions shares knowledge and practice.
That arrangement works well for investigator-initiated research. It also shapes the evidence you can show. A validation package, if one exists, was written by your institution or study team. The upgrade date was chosen locally. A security incident is handled by local IT. None of this is wrong. It means that an inspector's question lands on whoever runs your instance, and the study team must be able to name that person and produce their records. Our page on REDCap hosting and validation burden covers the workload in detail, and is REDCap 21 CFR Part 11 compliant? covers what the sources say about compliance status.
Where the gap is largest
Studies run under an IND, or supporting a marketing application, are inspected on the data system as well as on the site. Smaller studies with a sponsor who audits vendors will ask for qualification documents. In both cases the question "who is the vendor and where is their quality system" has no direct answer in a self-hosted model, so you need to supply a substitute answer.
- IRB/EC approved12-Aug-2026
- Contract executedConfirmed
- Site initiated / SIV completed02-Sep-2026
- Delegation log completeConfirmed
Pre-launch readiness
1 site activated
1 form not yet approved
Inspection-day questions
Eight questions to answer on paper before anyone asks
Whichever EDC you use, you can answer these questions or you cannot. This table shows who normally holds the answer in each model.
| Question | Self-hosted REDCap: who holds it | Vendor-run EDC: who holds it | Capture |
|---|---|---|---|
| Which version was running during the study? | Local REDCap team | Vendor release records | Ask us what version and release information we can provide. |
| Who validated the system, and when? | Institution or study team | Vendor package plus your assessment | Validation package available on request. |
| How were upgrades tested? | Local team, if documented | Vendor change control | Ask for the change control summary. |
| Who has access, and who removed it? | Study team plus local admin | Study team plus vendor admin | Role matrix; ask us how user access changes are evidenced. |
| Can the audit trail be altered? | Local configuration and database access | Vendor architecture | Append-only, field-level; hash-chained per study. |
| How are electronic signatures controlled? | Local configuration and procedures | Vendor workflow | Password re-entry and meaning statement for staff; email OTP for participants. |
| Where is data stored? | Institution's servers or cloud | Vendor hosting | EU (Frankfurt) or US (N. Virginia). |
| What happens in a security incident? | Local IT and privacy office | Vendor and you | Ask for the incident procedure; ISO 27001 certified. |
REDCap sentences describe the typical self-hosted pattern from public documentation and consortium material and should be checked against current documentation. Capture entries describe Capture only.
See the same questions answered in a vendor-run system
Build a study in the free sandbox, read the audit trail and role matrix, and compare the evidence with what your REDCap team can show.
Reduce the risk
From "we think IT has it" to a file you can hand over
Decide
Stay, supplement or switch: a decision path
- 1
Classify the study
Low-risk academic work may be fine on a well-run local instance. IND-supporting or sponsor-audited work is where evidence gaps hurt.
- 2
Ask your REDCap team for their documents
Validation summary, upgrade log, access procedure, incident procedure. If these exist, file them. If not, you have found the work.
- 3
Price the work, not the licence
Count the hours your institution spends keeping the evidence. See the true cost of REDCap versus an EDC.
- 4
Pilot the alternative
Run a small study in a vendor-run EDC for free. If you move, read how to migrate from REDCap.
Readiness
If you stay on REDCap, file these
System owner
A named person and deputy responsible for the instance.
Validation summary
Dated, specific to the version and to this study's use.
Change log
Upgrades and configuration changes with approval and test evidence.
Access review
Periodic user list review with sign-off.
Audit trail export test
Prove you can export the trail for a record and read it. See FDA inspection checklist for clinical trial data.
Does REDCap have no support at all?
No. Support is usually provided by the partner institution's local REDCap team, with documentation and community help from the consortium. What differs from a commercial EDC is that there is no single vendor that stands behind a validated release. Check current consortium terms.
Will an inspector reject REDCap?
This page does not say that. Inspectors assess whether the system was fit for purpose and controlled. A well-documented REDCap instance can be defended. An undocumented one is the risk.
Is REDCap 21 CFR Part 11 compliant?
Sources disagree and often describe it as a shared responsibility between software and institution. See our separate page on that question and ask your institution for its validation documents.
Should I move away from REDCap?
Not necessarily. Low-risk academic studies often run well on it. Consider a vendor-run EDC when your study is sponsor-audited or supports a regulatory submission, or when your institution cannot supply the evidence.
What does Capture offer instead?
Capture is a vendor-run EDC that is ISO 27001 certified and 21 CFR Part 11 compliant, with a validation package available on request, an append-only field-level audit trail, and EU or US hosting. You still own your own validated use.
Can I try it without commitment?
Yes. The free sandbox has every feature, no credit card and no time limit. You pay only when you go live with real participants.
Keep exploring
Related pages
REDCap vs Capture comparison
Head-to-head overview.
Is REDCap 21 CFR Part 11 compliant?
What the sources say.
REDCap hosting and validation burden
The workload behind the licence.
REDCap vs EDC for clinical trials
When each fits.
How to migrate from REDCap
A move without data loss.
FDA inspection checklist for clinical trial data
What to have ready.
Pricing
Free sandbox.
Compare the evidence side by side
Build a study in the free sandbox and see what a vendor-run EDC can show an inspector.