ARC (Animal Research Companion) is software from ANIML Health Inc. for running veterinary clinical trials. This page describes, in plain terms, how the hosted service keeps study records safe. It is a summary of what the software does, written from the code and its decision records; it is not a certification. For the details behind any of it, or to report a security problem, write to we.care@animl.health.
Where data is kept
- In Canada. Study records and files are kept in Canada (Amazon Web Services' Canada Central region) by default. An organization may keep its files in a storage bucket of its own instead.
- What leaves Canada, and when. Emails (sign-in links, invitations, notifications) are sent through SendGrid and pass through the United States. If your organization turns on Hachiko summaries (Beta), the clinical PDFs you send for a summary are processed by ANI-ML in the United States; nothing is sent until one of your administrators opts in. Website analytics run only on the public website, and only after a visitor accepts them. Our Privacy Policy lists every provider.
- On your own servers. ARC can also be installed on a server you control, in which case your data stays there.
Who can see what
- Invitation only. Nobody can create an account in a customer's organization on their own; people are invited by someone responsible for the study or organization.
- Roles per study and site. Each action needs the right role at the right study and site. Row-level security in the database applies these rules to every table, whatever the page or API asking.
- Identities stay at the site. Owner names, contact details, animal names and clinic record numbers are kept only at the enrolling site. Other sites, the coordinating centre, sponsors and monitors see subject codes. Viewing identifying details is itself recorded.
- Exports are de-identified by default. Identified exports need a site's own staff to ask for them, with a reason.
Signing in
- No passwords. People sign in with an emailed link, a one-time code or a passkey.
- A second factor for everyone. Every account confirms sign-in with a passkey or an authenticator app, enrolled at first sign-in.
- Sessions end. Idle sessions time out, and organizations can limit sign-in to their own networks.
The record and signatures
- An audit trail nobody can edit. Every change to every record is recorded in the same transaction: who made it, when (by the database's clock), the value before and after, and the reason. Hourly checkpoints chain the trail, so any alteration of recorded history shows.
- Electronic signatures. Each signature states its meaning (authored, verified, approved and so on), the signer's printed name and the time, and needs a second factor given in the last five minutes. A signed record that changes afterwards shows its signature as out of date; the signature is never removed.
- Locks and retention. Forms, visits and the database can be locked with signatures. Each study states how long its data is kept, and deletion needs a locked study whose retention has passed and a second person's approval.
Encryption and backups
- In transit. Every connection to ARC uses TLS.
- At rest. Owner contact details are encrypted field by field, and found through a blind index rather than stored in the clear. Files are stored encrypted.
- Backups. The database and the file list are backed up every day. Copies sent off the server are encrypted first, with a key that never goes with them, and are kept for 35 days. Restoring the newest copy into a scratch database is rehearsed every week, and integrity checks run on it.
Standards
ARC is designed to support the expectations of 21 CFR Part 11 (electronic records and signatures), VICH GL9 (good clinical practice for veterinary studies) and ICH E6(R3), and personal information is handled under Canada's PIPEDA.
ARC is not certified, and it has not been validated for your use: validating a computerized system for a regulated study is the responsibility of whoever runs the study. We give you the evidence for that work: a mapping of features to each requirement, the decision records, the automated test suites and the results of restore drills.
Reporting a problem
If you believe you have found a security problem in ARC, write to we.care@animl.health with what you found and how to reproduce it. Please do not test against other customers' data. Our vulnerability disclosure policy says what is in scope, what we ask of researchers and how quickly we answer; the same contact is in /.well-known/security.txt.