generated: '2026-09-14'
method: searched
source: https://aicure.com/company/data-privacy-security
name: AiCure conformance and compliance
summary: >-
  AiCure publishes a named compliance posture for its commercial clinical-trial platform - ISO 27001
  and SOC 2 certifications, and HIPAA, GDPR and 21 CFR Part 11 compliance for long-term storage of
  protected health information. Those are corporate/regulatory claims on its own security page, not
  contract-level assertions; the only machine-checkable conformance in the public surface is the
  OpenDBM REST API's use of the OAuth2 password grant and JWT bearer tokens.
conformance:
- id: iso-27001
  conforms: true
  category: certification
  evidence: https://aicure.com/company/data-privacy-security
  evidence_note: >-
    "AICure has also received ISO 27001 and SOC2 certifications." Self-asserted on AiCure's own
    security page; no certificate number, auditor or validity window is published, and no trust
    portal hosts the report.
- id: soc-2
  conforms: true
  category: certification
  evidence: https://aicure.com/company/data-privacy-security
  evidence_note: >-
    Same page. AiCure describes SOC 2 as covering security, availability, processing integrity,
    confidentiality and privacy, and notes the reports are restricted to specified parties - i.e.
    available on request under NDA, not published.
- id: hipaa
  conforms: true
  category: regulatory
  evidence: https://aicure.com/company/data-privacy-security
  evidence_note: PHI storage stated to comply with HIPAA.
- id: gdpr
  conforms: true
  category: regulatory
  evidence: https://aicure.com/company/data-privacy-security
  evidence_note: >-
    PHI storage stated to comply with GDPR; the page adds that AiCure makes or assists with required
    filings in each country a study deploys to.
- id: 21-cfr-part-11
  conforms: true
  category: regulatory
  evidence: https://aicure.com/company/data-privacy-security
  evidence_note: >-
    "21CFR11" named explicitly - FDA electronic records and electronic signatures, the controlling
    regime for computerised systems used in regulated clinical trials.
- id: oauth2
  conforms: true
  category: protocol
  evidence: https://aicure.github.io/open_dbm/extras/odbm-rest-api
  evidence_note: >-
    OpenDBM REST API implements the OAuth2 resource-owner password credentials grant at
    POST /odbm/v1/login and returns a bearer token. Password grant is deprecated in OAuth 2.1;
    recorded as implemented, not as recommended.
- id: jwt-rfc7519
  conforms: true
  category: protocol
  evidence: https://github.com/AiCure/open_dbm/blob/master/rest_api/app/services/auth/auth.py
  evidence_note: HS256-signed JWT access tokens.
- id: oidc
  conforms: false
  evidence: 'well-known/aicure-well-known.yml: no openid-configuration on any host'
- id: rfc9457
  conforms: false
  evidence: 'errors/aicure-problem-types.yml: plain {"detail": ...} envelopes, no problem+json'
- id: idempotency
  conforms: false
  evidence: 'conventions/aicure-conventions.yml: idempotency.coverage = none'
- id: pagination
  conforms: false
  evidence: No collection-returning operation exists on the published surface.
domain_standards:
  searched: true
  found: []
  note: >-
    The market standards worth probing for a clinical-trial data vendor are CDISC ODM/SDTM/Define-XML,
    HL7 FHIR (and the FHIR-to-CDISC mappings), and 21 CFR Part 11 audit-trail shapes. None is
    declared anywhere in AiCure's public contract surface: the OpenDBM REST API is a
    behavioral-measurement pipeline that emits bespoke CSV columns, and the commercial platform
    publishes no contract at all. AiCure's CRO/EDC/IWRS integrations described on the partnerships
    page are bilateral sponsor engagements, not a published standard conformance. Recorded as an
    honest empty result - this check is reward-only and nothing has been invented to fill it.