Security & Compliance

Designed for clinical research from the start. This page says what is in place today and what is still in progress.

Compliance at a glance

Business Associate Agreements

We sign a Business Associate Agreement with each HIPAA-covered research site we work with. Document storage, AI document processing and email run on AWS under our Business Associate Agreement with AWS. Agreements with our database and hosting providers are being put in place, and we are moving participant-question processing onto AWS Bedrock under our AWS agreement.

ICH-GCP Support

Designed to support ICH-GCP compliance, with approval workflows and an append-only audit log of changes to core records.

SOC 2 Type II

A SOC 2 Type II examination is planned. Contact us for our current security documentation.

Row-Level Data Isolation

Database row-level security restricts participant records to authorized users.

Infrastructure

Cloud hosting

The application runs on Vercel, the database and authentication on Supabase, and document storage, AI document processing and email on Amazon Web Services (AWS). Participant questions are answered with Anthropic's Claude models; we are moving that processing to AWS Bedrock. Our database and document storage are in US regions.

Encryption

Data is encrypted at rest by our database and storage providers (AES-256) and in transit over TLS, with HSTS enforced on the application.

Access controls

Role-based access control and database row-level security restrict each record to authorized users. Administrator accounts use multi-factor authentication. Changes to core records are written to an append-only audit log.

Data handling

Participant information, including account details, trial participation and the questions participants ask, is encrypted at rest and restricted to authorized users by row-level security, and AI-generated outputs are stored under the same controls. When a HIPAA-covered research site uses Clear Trials, this information is Protected Health Information, and we handle it under our Business Associate Agreement with that site. Participants enroll with an access code from their study team and sign in to a personal account.

AI Guardrails

Unlike general-purpose language models, Clear Trials operates within strict, contained boundaries designed in consultation with IRB professionals.

Human review of source content

Content drawn from your documents is reviewable and editable by your team, and approved before participants see it. Answers to participant questions are generated from those approved documents, cite their sources, and are recorded for review.

Document-bounded responses

The participant-facing Q&A answers from passages retrieved from your approved documents and cites them. It is designed not to give medical advice or make claims beyond what your materials state, and questions it can't answer from the documents go to the coordinator.

Audit logging

Changes to core records, including study documents, enrollments, access codes and caregiver sharing, are written to an append-only audit log with a timestamp and, when the change is made in the user's own session, that user's identity.

No promotional content

The platform is designed to preserve key information — including risks and limitations — without adding promotional language, minimizing adverse events, or encouraging participation beyond what the original documents state.

Documentation & Agreements

We provide the following documentation to support your compliance review:

Business Associate Agreement
Security questionnaire responses (HECVAT, or your own questionnaire)
IRB support documentation for your institutional review
Platform security architecture overview

Questions about security or compliance?

We're happy to walk through our security architecture and provide documentation for your compliance review.