Trust and legal / Public summary
Security Overview
The Security Overview covers access controls, record integrity, audit trails and electronic signatures.
Role-based access, record locking and signatures with re-authentication support accountable research workflows.
Kyros Trials staff access records only for requested support or a legal requirement, with named personnel access logged in the audit trail.
We never sell customer data, and customer data is never used to train AI models.
Customers can export their data at any time, including audit trails and signatures, and we do not delete data for non-payment.
The full agreement is in final legal review. Request a copy at legal@kyrostrials.com.
Request a copyAccess control and staff roles
Kyros Trials uses individual accounts, role-based access and study-scoped reviewer workflows. A coordinator, investigator, finance user and outside monitor do not need the same permissions. Review the exact records each role can reach during your adoption checks. Invitation and account administration are separate from granting study access.
Password rules, session controls and optional two-factor sign-in support account security. Signer two-factor requirements can apply through the organization’s setting. Staff should not share credentials, and departing users need their access reviewed. These controls support accountable work; the site remains responsible for its identity and access procedures.
Company data isolation
Organization context is established through the signed-in membership and effective-role workflow. Switching companies cancels queries, clears cached data and reloads the view to avoid carrying stale records across companies. Database access policies enforce record authorization; the navigation menu is not the security boundary.
Your organization should inspect a representative staff account and a scoped monitor account before onboarding a reviewer. Check both permitted records and records that must not be visible. Do not use production participant information as an informal access test in a public support conversation.
Audit trail and controlled signatures
Regulated changes use reasoned change or void workflows rather than ordinary deletion. Audit records retain responsible user, time, before/after values and reason. A void preserves the record and its history. Review the record-specific workflow because signing, locking and later correction are not identical for every record type.
Electronic signatures carry identity, date/time and meaning, link to the signed record and require password re-entry through a server-verified process. The browser cannot simply assert that re-authentication occurred. Compliance depends on how each site validates and uses the system, including credential management, training and review.
Infrastructure and backups: request current details
This overview does not assert an unverified encryption configuration, backup interval, recovery objective, storage-region arrangement or executed provider agreement. Request the current hosting and recovery details for your procurement review. Confirm both database and file-storage handling rather than assuming one backup description covers all records.
Your site should define continuity steps for unavailable service and maintain appropriate exports and original records. An accessible public endpoint is not evidence that a backup was restored successfully. Ask for the specific recovery scope and evidence relevant to your intended use; no guaranteed restoration time is published here.
Incident response and vulnerability reports
Report an interruption or suspected security issue to support@kyrostrials.com. Use a business contact, affected page, approximate time and reproducible description. Do not include participant data, passwords, access tokens or confidential files in ordinary email. Ask for an appropriate transfer method if supporting evidence contains sensitive information.
Use the same contact for responsible vulnerability reporting and identify the issue as a security report. Do not access other users’ records, disrupt the service or test against clinical data to demonstrate impact. Current incident and response arrangements are available on request; this page does not invent a clean ninety-day history or a guaranteed response window.
Procurement and customer data
We never sell your data. Customer data is never used to train AI models. Kyros Trials staff access records only when requested support or the law requires it, with access limited to named people and logged. Request the current provider and agreement information before sensitive use.
Customers can export records, including audits and signatures. We do not delete customer data for non-payment. Review the trust hub, data-retention summary and Part 11 guide alongside your procedures. No third-party security certification is claimed. Public content supports review but is not an executed contract or a regulatory determination.