What Trialion does to support a regulated trial, what evidence it produces, and what your organization still has to do.
Nothing here claims a certification. Software is not compliant on its own; an organization running validated software under controlled procedures is. These pages say which half is which, and every answer carries one of four statuses:
- Built: the software does this today, and the evidence is cited.
- Partly built: the software does part of this, and the limits are stated.
- Customer responsibility: the software cannot do this for you.
- Not built yet: asked for, or expected, and not done.
Start with these
- Audit trail and evidence: what is recorded, how tampering is detected, who can check it independently, and where it stops. Almost every regulatory claim rests on it.
- GAMP 5 and computer system validation: the honest position. No validation package is supplied, and that is a prerequisite for regulated use. It also lists what does exist.
- Not built yet: everything the system cannot do, in one place.
Regulation by regulation
- 21 CFR Part 11: electronic records and electronic signatures, clause by clause.
- ICH E6(R3) GCP: good clinical practice, topic by topic.
- ALCOA+: data integrity, attribute by attribute.
- Data privacy: HIPAA, GDPR and India's DPDP Act in one place, because the controls overlap.
- Security and hosting: what is built into the application, and what depends on how you deploy it.
The questions an auditor asks
Every page of this library ends its subject with the questions an auditor or a quality reviewer would ask about it, each answered with a status and the evidence. They are collected here, by regulation, so you can start from a clause instead of a screen:
- 21 CFR Part 11 matrix: every clause of subpart B and subpart C, with the questions that answer it.
- Other frameworks: EU GMP Annex 11, ICH E6 by topic, ALCOA+ and GDPR.
- All compliance questions: the full list, grouped by how far the software goes.
A clause with no answer is shown as a gap in this documentation, not as a statement that the software does nothing.
The division of responsibility
| Trialion provides | Your organization provides |
|---|---|
| A tamper-evident audit trail | The procedures that say who reviews it and when |
| Role-based access with separation of duties | The decision about who holds which role, and removing people who leave |
| Electronic signatures with a fresh code and the meaning recorded | The written accountability policy, the identity check before an account is issued, and the certification to the FDA (21 CFR 11.100) |
| A recorded GCP training confirmation at site activation | Training itself, its records and its enforcement |
| The software and installation-qualification tooling | The validation plan, requirements, risk assessment, IQ, OQ and PQ with signed evidence |
| A study design that is tested in UAT and released after three sign-offs | The validation that the design does what the protocol says |
| UAT and Live data kept apart by the database | The decision to use UAT before going live |
| Tooling and alerts for backups and restore checks | Installing and operating them, retention, disaster recovery, the network and the keys |
What is not claimed
Trialion is not certified against ISO 27001 or SOC 2, supplies no validation package, and does not by itself make an organization compliant with Part 11, HIPAA, GDPR or the DPDP Act. Where a control depends on infrastructure rather than the application (backups, disaster recovery, key management, retention), the pages say so instead of implying otherwise. Three things the system does not do are worth knowing before you start: it cannot run a blinded study, it does not record who read a record, and it has no randomization, supply or safety-gateway functions.