Nexrial's operational posture, measured live.
The operational metrics in the row below — migration head, last validation run, latest backup, and audit-log integrity — are read live from the same production database and filesystem the Nexrial platform runs on. The framework and recovery sections that follow are maintained by us and reviewed regularly. If a claim here is wrong, we'd want to know.
21 CFR Part 11 audit-trail integrity
The audit log is protected by three independent database-level defenses. All three are checked on every validation-harness run and must pass before a release is tagged.
audit_log_no_updateaudit_log_no_deleteaudit_log_no_truncatectms_app) with INSERT+SELECT only on audit_log. UPDATE, DELETE, and TRUNCATE are revoked at the GRANT layer before the trigger even fires. Migrator role (ctms) retains DDL rights for alembic only and is invoked at container startup.
Compliance frameworks
Preemptively-completed vendor-assessment artifacts. Available on request under NDA.
| Framework | Status | Notes |
|---|---|---|
| SIG Lite 2024 (Shared Assessments) | Pre-filled | Refreshed quarterly · for pharma sponsor / CRO buyers |
| HECVAT Lite 4.1.5 (EDUCAUSE / REN-ISAC) | Pre-filled | For academic medical center prospects |
| NIST CSF 2.0 self-assessment | Complete | Self-assessed against all five functions (Identify / Protect / Detect / Respond / Recover); control evidence available on request under NDA |
| 21 CFR Part 11 validation package | Drafted + automated execution | VAL-PLAN + IQ/OQ/PQ + VAL-REPORT · executed-run evidence on request |
| HIPAA BAA (45 CFR 164.504(e)) | Template ready | Includes 30-day breach notification, indemnification, liability cap, audit rights |
| SOC 2 Type II | Planned | Engagement planned · gap-analysis available on request |
| HITRUST CSF | Deferred | Evaluated on customer trigger |
Recovery & availability
0 */2 * * *. Continuous WAL archiving scheduled with enterprise-tier readiness.Anchor tenant disclosure
Nexrial's first production tenant is A1 Clinical Network (Queens, NY), a clinical research site specializing in gastroenterology, hepatology, and endocrinology. Nexrial has a commercial relationship with this site that predates general availability.
This relationship is disclosed proactively. It shapes the platform's early feedback loop: production behavior is observed daily by experienced clinical research staff with a direct incentive to surface issues, not hide them. A1 Clinical operates under the same Services Agreement and BAA offered to external tenants — no platform privileges are extended that would not be offered to any paying tenant of equivalent tier.
Enterprise-tier onboarding of external pharma sponsors and CROs is the commercial path. A1 remains an anchor reference; it is not the target customer profile.
Want the full VQP, BAA template, or a live demo?
All artifacts referenced on this page are available to prospective customers under NDA. Vendor-qualification-questionnaire completion (SIG Lite / HECVAT / custom) is offered as part of onboarding.