Stay Compliant, Stay Confident
We understand the importance of compliance and accuracy in clinical trials, and we take a risk-based approach to security. From physical security at the data centers to full audit-trail control at the data level — this is how Flex Databases helps you stay compliant, at every level.
21 CFR 11
HIPAA · GDPR
7 levels
of security coverage
ISO 9001
& ISO 27001 certified
GAMP 5
validation methodology
The Standards We Adhere To
Our security implementation lets us meet the standards and best practices your auditors already check for — demonstrating our commitment to customers' security and privacy.
21 CFR Part 11
Electronic records and electronic signatures held to the FDA standard — the foundation for e-records and e-signatures across every GxP module.
HIPAA
Protected health information handled to HIPAA requirements, so patient data stays secure across your studies.
No penalty for a small team
A two-person research unit isn't priced like a two-hundred-person CRO.
Clinical Trials Data Security
As a SaaS provider, Flex Databases pays great attention to the safety of data on all levels. We use only the best scenarios and industry practices to keep and protect customers' data — from physical security at the data centers to full audit-trail control at the data level.
1.
Processes
SOPs, IQs, PQs, WPs governing how the platform is built and run.
2.
Physical
Physical security at the data centers where your data lives.
3.
Infrastructure
Hardened infrastructure underneath the platform.
4.
Virtual environment
Isolated virtual environments protecting each layer.
5.
Application
Security built into the application itself.
6.
User
Role-based access and controls at the user level.
7.
Data
Full control using audit trail at the data level.
A Strict Backup & Disaster-Recovery Policy
Backups are retained at separate Flex Databases data centers, in a geographically different location within the same region as the primary data center — with the same level of physical and infrastructure security. All backups are encrypted in transit to the separate data center and encrypted at rest while stored there.
How we back up
- GFS (grandfather-father-son) rotation strategy
- Full backup every day, including weekends
- Incremental backup of all client data twice per day, including weekends
- Encrypted in transit and encrypted at rest
How long we keep it
- The last two weeks
- One backup per each month of the year
- The previous two weeks
- One backup per each year, all the time
Independently Certified
We've earned — and maintain — the certifications that prove our processes hold up to outside scrutiny.
ISO 27001:2022
Certified information security management.
Read the announcement →
ISO 9001:2015
Certified quality management.
Read the announcement →
GAMP 5
Validation methodology aligned to GAMP 5 guidance — the basis for how every system is validated.
We've successfully passed numerous external audits by esteemed international CROs, pharmaceutical companies and independent auditors.
Validation as a Service
In today's regulatory landscape, software validation isn't just an option — it's a necessity, mandated by bodies like the WHO Expert Committee and the EMA guideline on computerized systems in clinical trials. We apply our hassle-free, quality-driven validation experience to support our clients.
Based on GAMP 5
Our validation methodology follows GAMP 5 guidance, with an Agile & SCRUM approach — frequently updating systems to keep pace with industry trends and regulatory changes.
Ensures consistent performance
Validation ensures every computerized system used within a clinical trial consistently meets specified requirements — reliable and performing as intended throughout its lifecycle.
We guide your UAT
Our team guides you through the system during user acceptance testing, providing the documents you need — making the process smooth and efficient.
Validation Deliverables
We provide all the documentation to be included in your validation package — so when an auditor asks, the answer is already on the shelf.
Included in your validation package
- Validation Summary Report for all our validation efforts as system developer
- OQ Testing Summary Report
- Release Notes
- Maintenance Plan
- Documents covering every change made after first release to production
- User Requirements Specifications
- User Manual
- IQ documentation
- Training Certificates
Comprehensive services for GxP validation
- Formalized URS compliant with 21 CFR Part 11 for e-records and e-signatures
- Training per our QMS, industry standards and applicable regulations
- Deployment of your private cloud instance with IQ documentation
- Updated validation documents with every new system version, following risk-based approaches
Our Quality Management System covers all processes and supports vendor assessment with a comprehensive range of documents, ready for your audit needs.
Global Reach, Top Performance
Our data centers, located worldwide, are handpicked from an approved vendor list — ensuring both regulatory compliance and stable performance. All centers have passed vendor-assessment audits and comply with personal-data protection regulations.
For EU-based clients
Data centers in Germany and Finland — keeping EU data within the EU, compliant with GDPR and personal-data protection regulations.
For US-based clients
US data centers for American clients, so your data stays in your region — never mixed, never moved out of jurisdiction.
Regulatory Resources
The guidance our validation approach is built to satisfy — straight from the source.
Compliance: Frequently Asked Questions
Talk to us. See it yourself
Skip the generic demo. A specialist who works with this platform every day will walk you through it live, answer the hard questions directly, and show you exactly how it would run in your organization — not a script, not a slide deck.