Security and data protection

Practical controls for an early-stage clinical trial referral platform.

Clinical Trial Matcher is built with a security-first operating model: minimal patient data collection, encrypted managed infrastructure, limited access, no public staff dashboard, and clear referral workflows for pilot partners.

Implemented controls

Current application security posture.

Controls are designed for a focused pilot stage and will be expanded as partner requirements mature.

Encryption

Protected transport and storage

The application requires SSL/TLS for hosted Postgres connections. Trial and referral records are stored in managed Vercel Postgres/Neon infrastructure with provider-managed encryption at rest.

Access

Restricted operational access

There is no public staff dashboard or sponsor login portal. Referral access is limited to direct founder-operated workflows and approved routing channels during pilot engagements.

Minimal data

Limited patient collection

Interest forms collect only contact details, selected study interest, preference, notes, and basic eligibility confirmations needed to route a referral. Full medical records are not collected.

Web safeguards

Controls applied at the application edge.

Security headers

  • Content-Security-Policy limits script, style, image, and connection sources.
  • Strict-Transport-Security instructs browsers to use HTTPS.
  • X-Frame-Options denies clickjacking frames.
  • X-Content-Type-Options and Referrer-Policy reduce browser attack surface.

Abuse prevention

  • Patient lead submissions are rate limited to 10 per hour per IP.
  • Search traffic is rate limited to 100 requests per minute per IP.
  • Sponsor pilot requests are rate limited to 5 per hour per IP.
  • Honeypot fields and timing checks silently block common automated form spam.

Input validation

Form inputs are length-limited, validated, sanitized for display/storage, and checked for required fields before referral records are stored or notifications are sent.

Audit trail

Lead submissions are stored with study ID, selected fields, status, eligibility confirmations, and submission timestamp. This provides a basic operational audit trail for referral handling.

Compliance position

HIPAA-aware, without overstating certification.

Clinical Trial Matcher is not currently representing itself as a HIPAA-certified service or a covered entity. The platform follows HIPAA-aligned best practices appropriate for the pilot stage, including data minimization, encryption in transit, managed encrypted storage, limited access, and submission logging. Business associate agreement requirements, if any, should be reviewed as part of each pilot scope.

Need a security review?

We can provide the pilot package, due diligence Q&A, and a walkthrough of referral handling for qualified CRO and sponsor discussions.

Contact Security