SpeciGen is a multi-tenant SaaS platform for clinical trial sample tracking and biospecimen operations, hosted on Amazon Web Services. The platform absorbs vendor data feeds (central lab, PK/ADA biomarker, EDC, LIMS, pathology, imaging), generates per-subject projected collection schedules from the protocol, and runs continuous reconciliation against expected — with AI-assisted insights and submission-ready eTMF reports.
The stack is intentionally conservative for a regulated workload: a stateless Spring Boot backend serving a React (Vite) single-page application, PostgreSQL on Amazon RDS, Amazon Cognito for identity, AWS Secrets Manager + KMS for secret material, Cloudflare at the edge for TLS termination and DDoS protection, and AWS CloudTrail (multi-region, with log-file validation) for the infrastructure audit trail. Every reconciliation action is captured in a hash-chain audit trail at the application layer; electronic signatures bind SHA-256 hashes to responsible-party attestations.
Each sponsor operates within a logical tenant. Isolation is enforced application-side via per-study authorization filters in the Spring Security chain, with row-level filtering at the database. No data crosses tenant boundaries — verified by penetration testing.
Every reconciliation action, every electronic signature, every data mutation is recorded in an append-only audit log. Each entry's cryptographic hash chains to the previous entry — tampering with any record invalidates the chain forward.
Responsible-party attestations (discrepancy resolution, closeout certifications, reconciliation report acceptance) are bound to the user via Amazon Cognito identity and stored as SHA-256 signature hashes. 21 CFR Part 11 compliance attested by an independent third-party assessor (2026-Q2); attestation report available under NDA.
Aligned to ICH E6(R3) data integrity principles: Attributable, Legible, Contemporaneous, Original, Accurate — plus Complete, Consistent, Enduring, Available. Every data action carries user identity, timestamp, and is immutable in the audit log.
AES-256 at-rest across Amazon RDS, S3, EBS, and AWS Secrets Manager — all with KMS-managed keys. TLS 1.3 in transit at the Cloudflare edge and within the AWS VPC. KMS region-level default encryption enabled.
AI features (plain-English query, recon summaries, drafted vendor queries) are assistive — the deterministic reconciliation engine, audit trail, electronic signatures, and eTMF reports are the system of record. Humans are always in the loop on anything that gets recorded.
Amazon RDS automated daily encrypted snapshots with point-in-time recovery, 35-day retention. EBS snapshots 30 days. Application audit logs retained for the engagement plus 1 year. Annual DR exercise per SOP-013 (Backup & Restore).
AWS (hosting, identity via Cognito, LLM inference for AI features, observability), Cloudflare (TLS / edge protection). Each is governed under a signed BAA or DPA and tracked in our Subprocessor BAA Tracker under SOP-019 (Supplier Qualification).
| Connection | In Transit | At Rest | Protocol | Status |
|---|---|---|---|---|
| User ↔ Cloudflare | ✓ Encrypted | N/A | TLS 1.2+ | COMPLIANT |
| Cloudflare ↔ EC2 (Nginx) | ✓ Encrypted | N/A | HTTPS :443 | COMPLIANT |
| EC2 ↔ RDS (PostgreSQL) | ✓ Encrypted | ✓ KMS (AES-256) | JDBC/SSL :5432 | COMPLIANT |
| EC2 ↔ S3 | ✓ Encrypted | ✓ SSE-S3 (AES-256) | HTTPS | COMPLIANT |
| EC2 ↔ Cognito | ✓ Encrypted | N/A | HTTPS | COMPLIANT |
| EC2 ↔ Secrets Manager | ✓ Encrypted | ✓ KMS | HTTPS | COMPLIANT |
| EC2 ↔ LLM API | ✓ Encrypted | N/A | HTTPS | COMPLIANT |
| Cognito ↔ IdPs (SAML) | ✓ Encrypted | N/A | SAML 2.0 / HTTPS | COMPLIANT |
SpeciGen Platform Architecture — Confidential
February 2026