Home/Security and compliance
TrustSecurity and compliance
Everything an IT security review normally asks for, on one page, with nothing behind a form.
Last reviewed August 2026
Quick answers
The questions we are asked first
Written so this section can be copied straight into a security questionnaire.
Where is our data hosted?
Our cloud servers, in the region chosen at setup. You provision no storage.
Is data encrypted in transit?
Yes. SSL on all server traffic.
How often are backups taken?
Every 24 hours, to a location remote from the primary server.
Is the system penetration tested?
Yes, by an external service, once a year.
Who owns the data?
You do. We process it on your behalf and make no claim to own it.
Is a data processing agreement available?
Yes, on request.
Are sub-processors published?
Yes, with a change notification route.
Do you support single sign on?
SAML and OIDC, with roles mapped from your directory groups.
What is your accessibility conformance?
WCAG 2.2 AA, with a published statement.
Which certifications do you hold?
To confirm. We will state what we hold and what is in progress, and neither will be implied.
Hosting and location
| Where files sit | Our cloud servers. Submitted files and the database live together, in the region chosen at setup. |
|---|---|
| Provisioning | None on your side. There is no storage to buy and nothing to maintain. |
| Region | Chosen at setup and not changed without you asking for it. |
Protecting data
| In transit | SSL on server traffic. |
|---|---|
| At rest | To confirm. This needs a straight answer from the product side before it goes live. |
| Access control | Role based, down to the individual form field and attachment, by role and by stage. |
| Single sign on | SAML and OIDC. Roles map from your own directory groups, so leavers lose access when your directory says so. |
| Accountability | Actions taken by an administrator on another user's behalf are recorded in that user's name, not the administrator's. |
Backup and recovery
| Frequency | Every 24 hours. |
|---|---|
| Location | Remote from the primary server. |
| Format | Held in a form that can be re installed quickly if the primary server fails. |
| If you leave | The same backup is usable if it is transferred to you at the end of a contract. Your data does not become unreadable because a contract did. |
Your data and your rights
| Ownership | Yours. We are a processor, and we say so in writing. |
|---|---|
| GDPR | We operate under it. A processing agreement is available on request. |
| Retention and disposal | On your schedule, set per programme, and logged when it runs. |
| Export | At any time, as a zip with an XML of the metadata, or on a schedule to a destination you control. |
Testing and assurance
| Penetration testing | An external service, yearly. |
|---|---|
| Certifications | To confirm. If something is in progress rather than held, the page will say so and name the target. |
| Reporting a problem | To confirm. A responsible disclosure address belongs here. |
What we do not do
- We do not store a backfile from a previous system. Only what is submitted through PeerPath.
- We are a peer review service. We do not publish your material online for you.
- There is no packaged connector for clinical trial management or electronic data capture systems. The API is the route.
Get started
Tell us what you review.
We will show you the workflow.
Send us the outline of your process and we will build it in a session with you.