There is no password. You sign in with your email address and a six-digit code. The same page explains your session: how long it lasts, where it is listed and what signing a record asks of you.
Trialion is passwordless: there are no usernames or passwords, only an e-mail address and a one-time code. The browser holds a sealed, httpOnly session cookie that script on the page cannot read: the Backend-for-Frontend (BFF) keeps the tokens inside it and adds them to each call itself.
The first time: the invitation
Someone in your organization adds you by email address: the Organization Admin invites you to the organization, or a Project Manager adds you to a study. The invitation mail has a link, valid for 72 hours and for one use. The link opens a page that says Invitation: You have been invited to work in this organization on Trialion. We will email a one-time code to the address below to confirm it is you. Opening the link does not sign you in, and the address shown is the only one the invitation is for; it proves nothing until you enter the code.
| What the page says | What it means |
|---|---|
| Invitation, with your address | The link is valid. Ask for the code |
| This invitation link has expired | Seventy-two hours have passed. Enter your address and choose Email me a new link |
| This link has been replaced by a newer one | A newer link was sent. Use the latest mail, or ask for another by address |
| You have already joined | The invitation was accepted. Go to sign in |
| This invitation is no longer valid | An administrator withdrew it. Ask them to invite you again |
| This link is not valid | The link is incomplete or mistyped. Open it again from the mail |
| We could not check this invitation | The question could not be asked (a network problem). Try again |
| You have been invited, but are not on a team yet | You hold no role on any study or site, so there is nothing to sign in to; you are told when a team adds you |
If an invitation mail has no link or button, you have been invited with no role yet: you cannot sign in until a study team gives you a role (a Project Manager naming you on a study does it). That is by design, not a fault.
- Back to the sign-in page.
Every time
- Open the sign-in page (Secure Sign In) and enter your email address, then Send Verification Code.
- A six-digit code arrives by email. Enter it. It is valid for five minutes and allows three attempts.
- If you belong to more than one organization, choose the organization to sign in to (Changing it means signing in again). An organization that has invited you but has not given you a role is shown greyed and cannot be entered yet. That is the only choice: nobody is asked for a role, or for a workspace, at the door.
The sign-in page gives the same answer whether or not the address is registered, so nobody can use it to find out who works at your organization. A code is issued only to a person who holds at least one role.
If the code does not work
- After three wrong tries a code is spent: ask for a new one.
- A new code can be asked for after 60 seconds, and no more than three for one account from one address in 15 minutes. After too many wrong codes the page says Access Temporarily Restricted and counts down fifteen minutes: sign-in is paused in this browser window, and the account itself is not locked; the person it belongs to can still sign in from another window.
- A code that has expired fails even if you typed it correctly. Ask for another.
- Your address.
- E-mails a six-digit code.
- The six digits.
Your role is on the study, not at the door
A role is held on a study, or for site staff at a site of one, and a person has one role on a study, the same in UAT and in Live. Many people therefore work as different roles on different studies, a Data Manager on one and a Sponsor Manager on another, and the system never merges them: what you may do on a study is what your role on that study allows.
You sign in to no workspace. The dashboard and a study's own pages belong to none; you enter Build, UAT or Live from the study's Overview, and the dialog says what you will find there and the role you will work as. Entering a workspace starts a new session and ends the one it replaces. The header names your role on the study you are looking at. If a screen you expect is missing, check your role on that study first. Site staff are different: they work at one site, with one role, and a person with only UAT roles lands in UAT without being asked.
Staying signed in
- You are signed out after 15 minutes without activity (a click, a key, a touch). You are warned two minutes before, and the sign-in page tells you why you were signed out. Nothing you had already saved is lost.
- A session ends after 12 hours whatever you were doing.
- Every device you are signed in on is listed under Settings → Where you are signed in, where you can end any of them (Manage your settings and sessions).
- These times are the deployment's, shown on Settings → Security and policy; a deployment may set them differently.
Signing something
Signing a record (a completed form, a delegation of authority, a version sign-off, a database lock) asks for a fresh code by email, even though you are signed in, and your typed name. That is the re-authentication 21 CFR Part 11 asks of a signature: a deliberate act, not just an open session. The code you request for signing works only for signing and only for the record you requested it for; it cannot be reused for another. See Sign records.
Common problems
| What you see | What it means |
|---|---|
| "Your verification code has expired" | Five minutes passed. Ask for a new one |
| "The verification code you entered is incorrect. 1 attempt remaining" | Three tries per code |
| Access Temporarily Restricted | Too many wrong codes in this browser window. Wait the fifteen minutes, or use another window |
| You signed in but a study is missing | You have not been given a role on it, or you are signed in to another organization |
| You signed in but a screen is missing | Your role on that study does not include it (Finding your way around) |
| You were signed out | Fifteen minutes without activity, twelve hours, or an administrator suspended you |
The address with nothing after it
The bare address of the application opens Studies; when nobody is signed in you are taken to Sign in first. The platform console behaves the same way: its bare address opens Organizations, or the console sign-in when nobody is signed in (The platform console).
Two pages that nothing links to
The application has two plain pages that no screen, link or redirect leads to. You see them only by typing the address.
/auth/maintenancesays Scheduled maintenance: The CDMS platform is being upgraded. Sign-in and data capture will be unavailable for approximately 20 minutes. and Expected return: 22:20 UTC. The words and the time are fixed in the page. Nothing sets them, and nothing switches the application to this page during an upgrade./auth/unauthorizedsays Permission denied: You don't have the necessary role or policy to access this resource. The action has been logged in the audit trail. It offers Back to studies and Request access. The page records nothing itself, and Request access does nothing when chosen.
Neither is what you see when your role lacks a screen: the application then shows its own access denied screen in place of the page, and a Page not found screen for an address that names no screen (Finding your way around). A request the server refuses is recorded in the audit trail by the server, not by these pages (Review the audit trail).
- Does nothing when chosen.
Compliance Q&A
Yes. There is no password to share. Each code is single-purpose, valid for five minutes and three attempts, and is sent only to the account's address; repeated failures pause sign-in in that browser window and are recorded, and an account is never locked by someone else's guessing.
Limits: a one-time code by email is a single factor tied to a mailbox; a second factor and single sign-on are not built (Not built yet).
Evidence: server auth (six-digit code, five minutes, three attempts, 60-second cooldown, three codes per 15 minutescodes hashedno password)client Settings page shows the enforced valuessimulation of 20 Oct 2026, steps 2.1 and 2.4
Related
Manage your settings and sessions · Finding your way around · Invite and manage members · Sign records