Trust & Security
SpeciGen is designed for clinical trial workloads — regulated, audited, and dependency-heavy. This page is a plain-language account of the compliance frameworks we operate under, the architecture behind them, the subprocessors involved, and how to verify our claims.
Compliance Posture
Honesty over marketing. The framework matters less than what a customer can actually verify. Where we’ve been assessed, we list the assessor category and the evidence path. Where we’ve chosen a different investment, we say so.
On SOC 2
SOC 2 Type I is targeted for early 2027. We prioritized clinical-trial-specific frameworks first (HIPAA + 21 CFR Part 11, both attested by an independent third-party assessor in 2026-Q2) because they cover the majority of the SOC 2 Trust Services Criteria that apply to a PHI-handling platform, plus the electronic-records controls SOC 2 does not address. SOC 2 audit engaged for early 2027 to complete the general-purpose SaaS trust posture. Happy to walk through the current control mapping under NDA in the meantime.
Security Architecture
SpeciGen runs as a multi-tenant SaaS on AWS with tenant isolation at every layer, deterministic authorization at the API tier, and a hash-chain audit trail at the application tier. Full architectural detail is on the Architecture page.
Identity
User pools with password policy, MFA support, unique user identification bound to every audit record and electronic signature.
Access
Role-based access at the tenant, study, and per-user-per-vendor scope. Authorization enforced in a Spring Security filter chain independent of business logic.
Encryption
EBS + RDS + S3 encrypted with AWS-managed KMS keys. Region-level EBS default encryption enforced. TLS terminated at Cloudflare with full-strict mode to origin.
Audit Trail
Every reconciliation and edit action recorded with a SHA-256 hash chain. Full field-level before/after diffs. Tamper-evident by construction. Independently mirrored to CloudTrail for infrastructure operations.
Secrets
No secrets in code, in environment files, or on disk. IAM instance profiles for runtime credential resolution. Rotation supported at the secret layer.
Isolation
Tenant key propagated from JWT through service layer to database row-level scope. Cross-tenant access impossible by construction, verified in the API test suite.
Subprocessors
Complete list. Changes are announced at least 30 days in advance to customers with active contracts.
Notified changes: subscribe by emailing [email protected].
Data Handling
Customer study data
Sample manifests, EDC extracts, lab result files, e-requisition PDFs, kit inventory, protocol schedules. Encrypted at rest, tenant-partitioned. Retained per customer contract; deleted on termination within 30 days.
User account data
Email, name, role, MFA credentials (via Cognito). Retained while account is active. Deleted on request.
Audit & access logs
Every action recorded with user, timestamp, and payload hash. Retained for the life of the study plus regulatory retention period. Log-file validation enforced at the storage layer.
What we don’t collect
No subject-level identifiers beyond what the sponsor/CRO already uses in their EDC. No behavioral tracking beyond aggregate marketing-site analytics. No selling of data, ever.
Incident Response
Detection
Application-layer monitoring, CloudWatch alarms, and audit-log anomaly rules feed on-call notifications.
Customer notification
Confirmed security incidents affecting customer data are communicated to the impacted customer’s designated contact within 72 hours of confirmation, with a summary of scope, actions taken, and mitigation.
Post-incident report
A written post-incident report is provided within 14 days, covering root cause, timeline, remediations, and prevention measures.
Recovery
RDS automated backups, cross-AZ deployment, snapshot restore. Documented recovery procedures. RTO / RPO targets available under NDA.
Reach the Security Team
We welcome coordinated disclosure of security issues from independent researchers, customers, and partners. Report in good faith and give us reasonable time to respond — we won’t take legal action against research conducted responsibly.
For general inquiries: [email protected]
Attestation reports available under NDA on request.
Last reviewed: 2026-08-07 · Contact [email protected] for the current signed version.