VendorVigilance
Audit-ready platform

Compliance & validation

VendorVigilance supports ICH E6(R3) and 21 CFR Part 11 requirements, and is aligned with EudraLex Annex 11 and ALCOA++ principles.

  • ICH E6(R3) aligned

    Good Clinical Practice

  • Part 11 & Annex 11

    Electronic records

  • ALCOA++ aligned

    Data integrity

  • Cyber Essentials Plus

    Company cybersecurity

Standards

Mapped to the regulations you're inspected against

VendorVigilance provides technical controls aligned with ICH E6(R3) Section 4.3.4, 21 CFR Part 11, and EudraLex Annex 11 requirements for computerised systems in regulated research.

Validated every release

Every release is validated against 410+ automated test cases covering business logic, permissions, and audit trail generation.

Complete audit trail

Immutable, timestamped records of all user actions. Exportable for inspections and regulatory submissions.

Role-based access

Admin, Editor, and Viewer roles with study-level scoping. Multi-factor authentication and SSO available.

Validation documentation

Validation and security documentation is available inside the app, with a detailed changelog for every release.

Data integrity

ALCOA++ data integrity

How VendorVigilance supports each ALCOA++ principle of data integrity.

  • Attributable

    User attribution for all actions

  • Legible

    Clear, readable data exports

  • Contemporaneous

    Automatic timestamping

  • Original

    Immutable audit records

  • Accurate

    Validated data handling

  • Complete

    Nothing deleted or lost

  • Consistent

    Standardised formats

  • Enduring

    Continuous backups

  • Available

    Audit trail exportable for inspections at any time

  • Traceable

    Every change linked to who, when and the previous value

Security

Security and infrastructure

Cyber Essentials Plus certified, hosted on Fly.io in the EU and US.

Infrastructure

Cloud provider
Fly.io
Regions
EU (Amsterdam), US (Virginia)
Uptime SLA
99.9%
Hosting certifications
SOC 2 Type II, ISO 27001 data centres

Data protection

Encryption at rest
AES-256
Encryption in transit
TLS 1.2 / 1.3
Backups
Continuous + offsite
Recovery point
Minutes (PITR)

See VendorVigilance in action

A one-hour walkthrough of how your vendors, studies and qualifications would look in VendorVigilance.

Explore the product

No commitment required.