Yes. Castor EDC/CDMS is designed from the ground up to protect sensitive clinical research data. Our security posture combines independent third-party certifications, robust technical safeguards, and strict regulatory compliance.
Security Statement: https://www.castoredc.com/security-statement/
Key Security Measures
-
Data Encryption:
- In Transit: All data sent to and from Castor is encrypted using industry-standard TLS 1.2 or higher.
- At Rest: Stored data and backups are encrypted using AES-256.
- Application-Level: An optional Field Encryption Module is available for personally identifiable information (PII).
-
Access & Authentication:
- Role-based access control (RBAC) ensures users only see authorized data.
- Features automatic session timeouts (20 minutes), account lockouts after failed login attempts, and support for Two-Factor Authentication (2FA) and Single Sign-On (SSO).
-
Audit Trails & Data Integrity:
- Every record creation, update, query, and export is automatically tracked in an immutable, time-stamped audit trail compliant with ICH-GCP and FDA 21 CFR Part 11.
-
Proactive Security Testing:
- Castor undergoes regular independent third-party penetration testing and continuous vulnerability scanning.
-
Isolated Cloud Infrastructure:
- Applications and databases are hosted on dedicated, hardened virtual private environments on Microsoft Azure, with production databases completely isolated from the public internet.
Certifications & Compliance
Castor adheres to internationally recognized quality and data protection frameworks:
- Certified Standards: ISO 27001 (Information Security), ISO 9001 (Quality Management), and NEN 7510 (Healthcare Information Security).
- Regulatory Alignment: Fully compliant with ICH-GCP (E6 R2), FDA 21 CFR Part 11, EU Annex 11, GDPR, and HIPAA.
Learn More
- For a comprehensive breakdown of our technical and organizational security controls, see our Helpdesk: Security Statement.
- To learn more about our certifications, visit Helpdesk: ISO Standards.
- For vendor security assessments or audit inquiries, contact Castor Compliance at compliance@castoredc.com.