Security & Compliance

Honest about what we have today, what is coming, and what we do not do. We match IRBNet's public posture, nothing more (yet). Compliance investments scale with customer demand.

What we have today

✓End-to-end encryption (TLS 1.3 in transit, AES-256 at rest)
✓Zero-retention LLM contracts (Anthropic, no-training default)
✓MFA on all accounts (via auth provider)
✓Per-user audit log
✓HIPAA + BAA available on request
✓Vendor BAAs in place (Anthropic, Vercel, Resend)

What is coming (customer-triggered)

Each layer activates when customer demand justifies the spend. We do not invest speculatively.

→SOC 2 Type I — committed when first institutional pilot signs
→SOC 2 Type II — 12 months after Type I
→SAML / OIDC SSO — at first institutional contract (Stage 2)
→21 CFR Part 11 e-signatures — for FDA-regulated trial customers
→ISO 27001, HITRUST, FedRAMP — on customer demand

What we do not do

✗Store PHI
✗Sell or train on customer data
✗Hide our compliance posture
✗Replace your IRB office
✗Approve protocols ourselves

ConductCompliance is software for preparing IRB submissions, not an IRB itself. PIs use ConductCompliance to draft their IRB application, HIPAA waiver, consent forms, and protocol document. They then submit to whichever IRB their study actually uses (their university IRB, a commercial IRB like WCG or Advarra, or a single IRB of record for a multi-site study). We are upstream of review. Your IRB has final authority.