Platform foundations: who did what, and when

Trust

• A platform for clinical trials is judged on one thing: can you prove who did what, and when?
• In MAESTRO, that proof is not a feature of one tool. It is built into the platform underneath them all.

Access

• Access starts with roles. Fifteen are built in, from principal investigator to data manager, and you can add your own.
• Permissions are checked on every request, and built-in roles have no permission to delete trials, sites or participants.
• Sign in with single sign-on, add two-factor authentication, and sessions end after thirty minutes of inactivity.

Evidence

• Across 136 record types, changes write an audit entry: who, what, before and after, and from where.
• Filter the trail, and export it as CSV or PDF. There is no screen to edit or delete an entry, even for a superuser.
• One electronic signature is shared by documents, quality, audits and vendors: your password again, the meaning, and the time.
• Each signature is sealed. If one is altered afterwards, verification names the field that changed.

Validation

• A draft validation package sits alongside the code: 264 requirements, 145 risks, and automated installation, operation and performance tests.
• One command runs them all again and rebuilds the evidence, with a checksum on every file.

Hosting

• Each client gets its own stack in Montreal: its own network, its own database, its own storage.
• The database is encrypted and backed up for thirty-five days. Files are versioned and encrypted too.
• To connect your other systems, there is an API, and outgoing webhooks.
• API tokens are stored hashed, expire after ninety days by default, and warn you before they do.

The platform under MAESTRO: roles, an audit trail and signatures, shared across the tools.