Security & Compliance

1. Certification status

2. What this document is — and is not

This is a diligence overview describing control design and practices, current as of the issue date. It is not a certificate, an audit report, an attestation, a legal opinion, or a substitute for the customer’s own validation, qualification and standard operating procedures. Binding commitments are established only in the executed agreement and the Data Processing Agreement (DPA).

3. Regulatory guidance the design supports

Adaptrials maps adaptive-design and statistical-decision concepts to published regulatory expectations and makes the evidence chain visible. Alignment with guidance is a design property; it is not a claim of validated conformance, which remains a sponsor responsibility.

• FDA — Adaptive Designs for Clinical Trials of Drugs and Biologics (2019): simulation, pre-specification and decision-rationale concepts are exposed for sponsor review and independent simulation validation.
• ICH E6(R3), E8(R1), E9(R1): quality-by-design and critical-to-quality thinking, and structured fields for estimand attributes and sensitivity-analysis planning.
• 21 CFR Part 11: enabling technical controls for trustworthy electronic records (see section 7). Part 11 conformance for a given regulated process is determined and validated by the customer.
• EU GDPR — Regulation (EU) 2016/679: operational framework for lawful processing (see section 8).
• ALCOA++: data integrity attributes carried with each result — source lineage, frozen data cuts, mapping versions and reproducible historical views.
• CDISC SDTM / ADaM: dataset-specification structure; generated artefacts require qualified statistical review and are not validated submission deliverables on their own.

4. Intended processing scope

In scope:

• Business and professional contact data for investigators, coordinators, sponsor and CRO personnel.
• Study design records, statistical analysis plans, dataset specifications, simulation inputs and outputs, decision rationale, approvals and audit evidence.
• Authentication data, single sign-on identifiers, encrypted connected-service credentials, security telemetry and product usage events.

Out of scope: identifiable patient or trial-subject data and source clinical records are not part of the intended scope. Customers should prevent their inclusion unless a separately reviewed and contracted use case permits it.

5. Shared responsibility

6. Hosting, data residency and tenancy

• The production service is hosted in the European Union. Deployment and sub-processor detail specific to a customer environment is available under enterprise diligence.
• Data in transit is protected with TLS 1.2 or above. Stored secrets and connected-service credentials are encrypted at rest with AES-256, with key material held in a managed secret store.
• Public evaluation and demonstration workspaces use synthetic data only and do not authorize any clinical action.
• Customer workspaces are separated through application-level authorization scoped to the organization. Hardened multi-tenant isolation controls and their independent testing are a defined roadmap item and are described per deployment.
• Where an AI feature is enabled, only the minimum relevant content is sent to the configured model provider; some providers process in the United States under contractual transfer safeguards. AI processing can be disabled for a tenant.

7. Identity, access and auditability

• Unique user accounts, role-based access and least-privilege administration. Single sign-on via OpenID Connect is supported. Administrative access to production requires multi-factor authentication.
• Activity is attributable: user- and time-linked events, with append-only audit records for defined regulated objects and hash-based integrity for versioned content.
• Configuration is controlled content — statistical definitions, thresholds, decision rules and AI prompts are versioned.
• Reproducibility: a historical result can be recomputed from the same source snapshot and the same code and configuration version.

How we word the claim: Adaptrials supports 21 CFR Part 11-aligned electronic-record controls. Part 11 applies to electronic records and signatures within a regulated process; Adaptrials provides the supporting technical controls, and the customer determines intended use and completes procedural and validation responsibilities. We make no blanket certification claim.

8. GDPR, privacy and AI governance

• Role: Aomics GmbH acts as processor for customer-entered records, documents and workflow data, governed by documented customer instructions, the contract and the DPA.
• Data-subject rights: support for access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with a supervisory authority.
• Restricted transfers: EU Standard Contractual Clauses (2021/914), transfer impact assessment and supplementary measures where applicable.
• Subprocessors: written terms, confidentiality and security obligations, change notice and transfer safeguards.
• AI data handling: customer content is never used to train Aomics models or third-party foundation models; AI runs only in an enabled workflow invoked by an authorized user; only the minimum relevant content is sent; content is not shared across customers or added to a shared knowledge base; generated output carries citations, uncertainty and limitations, and an authorized human owns the decision, rationale and approval.

9. AI transparency (EU AI Act)

Adaptrials includes AI-assisted features (the decision copilot). The points below describe how the platform is designed and operated in light of Regulation (EU) 2024/1689 (the Artificial Intelligence Act), whose obligations apply on a staggered timetable through 2027. This is a transparency statement, not a declaration of conformity or a claim of certification.

• Interacting with an AI system (Art. 50(1)): where you use the copilot or another AI-assisted feature you are interacting with an AI system; those areas are identified as AI-assisted in the interface.
• AI-generated output (Art. 50(2), (4)): summaries, drafts and recommendations produced by the AI are presented as machine-generated and always carry their sources, uncertainty and stated limitations. The platform does not generate synthetic audio, image or video and is not used to produce deepfakes.
• Human oversight: no AI output takes effect automatically. Every disposition, rationale and approval is made and recorded by an authorized human reviewer; the AI provides decision support only.
• Role and risk classification: Aomics GmbH offers the software as decision-support tooling and, in this environment, a synthetic sandbox — it is not placed on the market as a high-risk AI system. A customer that deploys it inside a regulated clinical or quality process is the deployer for that use and is responsible for classifying that use and for any obligations that attach to it (see section 5).
• Prohibited practices (Art. 5): the platform performs no social scoring, emotion recognition, biometric categorisation, subliminal or manipulative techniques, or untargeted scraping of facial images.
• Training data: customer content is never used to train Aomics or third-party foundation models (see section 8); model providers used for AI features operate under written terms and retain no customer content for training.
• AI literacy (Art. 4): Aomics maintains internal AI-literacy measures for staff who build and operate these features; AI literacy for a customer’s own users of a deployed system is a deployment responsibility.
• Changes: as AI Act guidance and harmonised standards mature, this statement and the underlying controls will be updated and versioned with the rest of this document.

10. Monitoring, incident response and resilience

• Application and infrastructure telemetry with automated alerting on error rates and resource thresholds; controlled change through code review, automated testing and dependency scanning.
• Incident lifecycle: detect and assess, contain and remediate, notify, then review. Qualifying personal-data breaches are handled without undue delay under the DPA and applicable GDPR Article 33 and 34 obligations, followed by root-cause analysis and control improvement.
• Backups are taken with a defined retention period and periodic restore testing. Recovery objectives are defined per deployment and confirmed in the implementation scope.

11. Assurance roadmap and diligence package

A certification programme is under consideration and preparation; none is formally active at the date of this document. Any assurance programme will be published with its own scope and timeline.

• SOC 2 / ISO 27001: no report or certificate has been issued and no audit is in progress.
• HIPAA: not applicable to the intended scope, which excludes protected health information. HIPAA controls and a Business Associate Agreement would be scoped only for a separately contracted use case involving PHI.
• GxP: the software is designed to support customers’ GxP-regulated workflows; computerised-system validation for a specific regulated use is a shared responsibility completed by the customer for their intended use.

Available through enterprise diligence:

• Platform architecture and data-flow documentation.
• Security control and credential-encryption descriptions.
• DPA, subprocessor schedule, transfer and incident-response information.
• Implementation-specific data mapping, role model, retention configuration and validation evidence.

References

eCFR 21 CFR Part 11 · U.S. FDA “Part 11, Electronic Records; Electronic Signatures — Scope and Application” · EUR-Lex Regulation (EU) 2016/679 · Regulation (EU) 2024/1689 (Artificial Intelligence Act) · ICH E6(R3), E8(R1), E9(R1) · FDA “Adaptive Designs for Clinical Trials of Drugs and Biologics” (2019).

Evidence basis. Consolidated from Aomics platform architecture, security, data-protection and DPA materials current as of 4 September 2026. Customer-specific commercial terms and named-customer information are excluded.