Skip to main content
Trust & Transparency · Live posture — generated 2026-07-22T13:19:12.484861+00:00

Nexrial's operational posture, measured live.

The operational metrics in the row below — migration head, last validation run, latest backup, and audit-log integrity — are read live from the same production database and filesystem the Nexrial platform runs on. The framework and recovery sections that follow are maintained by us and reviewed regularly. If a claim here is wrong, we'd want to know.

Migration head
50303bf94be7
0 total migrations shipped
Last validation run
No run on disk
Latest backup
No backup on disk
Audit-log integrity
3 / 3 defenses live
Verified in validation run above

21 CFR Part 11 audit-trail integrity

The audit log is protected by three independent database-level defenses. All three are checked on every validation-harness run and must pass before a release is tagged.

UPDATE blocked
Rewrite rule audit_log_no_update
Live
DELETE blocked
Rewrite rule audit_log_no_delete
Live
TRUNCATE blocked
BEFORE TRUNCATE trigger audit_log_no_truncate
Live
Plus: application runtime uses a least-privilege database role (ctms_app) with INSERT+SELECT only on audit_log. UPDATE, DELETE, and TRUNCATE are revoked at the GRANT layer before the trigger even fires. Migrator role (ctms) retains DDL rights for alembic only and is invoked at container startup.

Compliance frameworks

Preemptively-completed vendor-assessment artifacts. Available on request under NDA.

Framework Status Notes
SIG Lite 2024 (Shared Assessments)Pre-filledRefreshed quarterly · for pharma sponsor / CRO buyers
HECVAT Lite 4.1.5 (EDUCAUSE / REN-ISAC)Pre-filledFor academic medical center prospects
NIST CSF 2.0 self-assessmentCompleteSelf-assessed against all five functions (Identify / Protect / Detect / Respond / Recover); control evidence available on request under NDA
21 CFR Part 11 validation packageDrafted + automated executionVAL-PLAN + IQ/OQ/PQ + VAL-REPORT · executed-run evidence on request
HIPAA BAA (45 CFR 164.504(e))Template readyIncludes 30-day breach notification, indemnification, liability cap, audit rights
SOC 2 Type IIPlannedEngagement planned · gap-analysis available on request
HITRUST CSFDeferredEvaluated on customer trigger

Recovery & availability

RPO (data loss window)
2 hours
Bounded by backup cron 0 */2 * * *. Continuous WAL archiving scheduled with enterprise-tier readiness.
RTO (time to restore)
4 h target
Most recent measured data-layer restore drill: under 5 seconds to restore and row-count-verify a 5-table sample set (2026-04-18). This validates the restore mechanism; the 4-hour RTO target reflects a full operational restore including redeploy and end-to-end verification.
Uptime target
99.5%
Availability is monitored; historical uptime data is available to customers under NDA once a reporting baseline is established.
Off-site replication: encrypted backup artifacts are replicated to an independent, access-controlled target consistent with HIPAA §164.308(a)(7)(ii)(A), with additional replication maintained for redundancy. Encryption: AES-256 (GPG) on every backup artifact before it leaves the application host.

Anchor tenant disclosure

Nexrial's first production tenant is A1 Clinical Network (Queens, NY), a clinical research site specializing in gastroenterology, hepatology, and endocrinology. Nexrial has a commercial relationship with this site that predates general availability.

This relationship is disclosed proactively. It shapes the platform's early feedback loop: production behavior is observed daily by experienced clinical research staff with a direct incentive to surface issues, not hide them. A1 Clinical operates under the same Services Agreement and BAA offered to external tenants — no platform privileges are extended that would not be offered to any paying tenant of equivalent tier.

Enterprise-tier onboarding of external pharma sponsors and CROs is the commercial path. A1 remains an anchor reference; it is not the target customer profile.

Want the full VQP, BAA template, or a live demo?

All artifacts referenced on this page are available to prospective customers under NDA. Vendor-qualification-questionnaire completion (SIG Lite / HECVAT / custom) is offered as part of onboarding.