Architecture and Assurance Roadmap

The platform is architected around controls that align with the objectives of the regulatory frameworks our customers operate under. Formal attestations provide independent validation of those controls as the platform and company mature.

We make commitments in two stages. The architectural commitments are made on day one of every customer engagement, regardless of which attestations have been issued. The attestation commitments follow as customer demand, regulatory evolution, and platform maturity make them useful.

Items move from Planned to In Progress to Current as the corresponding work is completed and, where applicable, independently validated.

The distinction between architectural implementation and independent external assurance is important and easily confused. The table below makes it explicit.

These controls are implemented in the platform regardless of whether a formal attestation has been completed.

PrismCDM prioritizes architectural controls before independent attestations because durable platform controls benefit every customer immediately, while attestations validate those controls at defined points in the company's maturity. Architecture is the substrate; attestation is the audit of the substrate.

One concern enterprise procurement teams have about an in-progress SOC 2 is: what evidence can you show me today? The answer is below. The evidence is real; the format is shared during the Compliance Review under NDA.

Each capability the platform implements maps to one or more independent assurance mechanisms. The mapping makes the relationship between architecture and attestation visible.

• Independent 21 CFR Part 11 validation. Independent validation of the Part 11 architectural alignment. The platform is architected against the Part 11 objectives today; independent validation issues formal evidence against them.
• SOC 2 Type I readiness. Security, availability, processing integrity, confidentiality, and privacy controls under active review. Formal audit engagement targeted within the design partner phase.
• Third-party penetration testing program. Annual third-party penetration tests of the platform with documented findings and remediation tracking.

• SOC 2 Type II. Continuous-operation attestation following SOC 2 Type I.
• ISO 27001. Information security management system certification.
• HITRUST consideration. Evaluating HITRUST CSF certification as customers in healthcare segments express demand.
• EU AI Act readiness review. Structured review of platform features and customer use cases against the AI Act's obligations as it enters force.

PrismCDM does not promise to be certified against every framework at every moment. We make architectural commitments that benefit every customer immediately, and we add formal attestations as they become useful to our customers. We do not market against attestations we have not earned.

Material movements on this roadmap (an item moving from Planned to In Progress to Current) are reflected here and communicated through the platform or by email to commercial customers where required by the executed agreement.

If a regulatory framework or attestation is material to your evaluation of PrismCDM and is not represented above, we want to know. Contact us through /contact with reason “Compliance Review”. Customer demand is the most important signal for prioritizing additions to the Planned column.

Our objective is not to accumulate certifications. Our objective is to build a platform whose architecture supports regulated clinical development, then obtain independent assurance that validates those architectural commitments over time.

• Security
• Responsible AI Architecture
• Subprocessors and Trust Boundary
• Data Processing Agreement
• Business Associate Agreement
• Privacy Notice