Trust & security

Verdatic works on synthetic data by design. There is no import path for patient-level records and nothing to de-identify — the strongest privacy control is not needing the data in the first place.

An append-only audit log records who changed what and when, with the previous value kept beside the new one — across projects, mappings, linkage decisions, releases, reference ranges, and accounts. Entries can't be edited or deleted; export is admin-only.

Every request carries an authenticated user. Sign-in goes through your identity provider, and three roles — Admin, Curator, Viewer — decide what each person can do. Admin-only operations are enforced at the API, not just hidden in the interface.

The same inputs and seed produce the same data, the same programs, and the same Define.xml. Anything Verdatic produced can be re-derived and compared — which is also how altered records are detected.

Datasets are checked by the official CDISC CORE engine, not our interpretation of it. Findings become a worklist with a recorded decision on each one and run-over-run deltas.

A written package for your CSV file — intended-use and risk assessment, validation master plan, SDLC and change control, data-integrity/ALCOA+ statement, a 21 CFR Part 11 controls matrix, and a requirements-traceability matrix citing the automated tests. The document index is published below.

Verdatic doesn't apply electronic signatures to regulated records, so Part 11 Subpart C is documented as Not Applicable with rationale. If your intended use needs it, tell us — it's a scoped addition, not a rewrite.

We ship our own validation evidence and test results. An independent CSV/GAMP 5 qualification and a penetration test are on the roadmap; we'll publish status as it progresses.

No certification is claimed today. SOC 2 readiness begins once the first guided-access engagements are underway.

NDAs are standard before anything starts. DPAs are available for guided-access engagements; terms are agreed during onboarding.