Defensible beats fast. This is both.

Under GDPR, truly anonymized data falls outside the Regulation’s scope, while pseudonymized data — reversible by design — remains personal data. In practice zero re-identification risk is not achievable, so the defensible standard for GDPR data anonymization is a risk you can measure and show, not a claim of perfection. TrialAssure ANONYMIZE® quantifies residual re-identification probability against the threshold you set, records which transformation was applied to each quasi-identifier, and keeps that methodology exportable. The distinction only helps you if you can evidence it: an unsupported assertion that data is anonymous is the hardest position to defend after the fact.

Re-identification risk is calculated as a probability and compared with a threshold you set before release, so the decision rests on a number rather than an opinion. The engine measures how uniquely the surviving quasi-identifiers — age, sex, site, visit dates, rare events — could single a participant out. The 0.09 (9%) reference threshold used by the EMA and Health Canada is a common starting point, and the score is taken against the highest-risk participant in the documents rather than an average, so one unusual case cannot hide behind the crowd. Scores above your threshold trigger further generalization and a rescore.

Redaction blacks out text; anonymization transforms it. Redaction produces no risk score and often destroys scientific value, because dose, timing and outcome context disappear along with the identifier. Anonymization generalizes values, offsets dates and masks quasi-identifiers so the data still supports analysis, then measures the residual re-identification risk. EMA and Health Canada guidance both favor risk-based anonymization over blunt redaction of personal data. Redaction still has a legitimate role for commercially confidential information, where the goal genuinely is to remove content rather than preserve its analytical value — the two techniques answer different questions, and most releases need both.

Transparency specialists sign off, not the model. The AI proposes transformations at scale; specialists review that work and correct it where it is wrong, so the release you sign off on has already been checked — with every verification logged, timestamped and attributable to a named reviewer. Nothing goes out on model output alone. That is what “AI Enabled. Human Driven.” means in practice, and for legal and privacy teams it matters twice over: you get a person who can explain a specific decision under questioning, and a record showing who made it and when — accountability that survives staff turnover.

No. Under our data processing terms, your data is not used to train public models, and it is never shared between customers. Processing runs in a closed, Azure-hosted environment with encryption in transit and at rest, so your documents are not handed to a third-party model provider to learn from. Those terms are documented in the Trust Center and repeated in the DPA, which means your privacy team can treat the commitment as a contractual obligation rather than a marketing line, and cite it directly in a vendor assessment or a record of processing activities.

The security architecture, our certifications, and how to request the security documentation pack — which contains the current sub-processor list and the DPA — are all set out in the Trust Center, so your privacy team can review them as part of its own assessment rather than waiting on a questionnaire response.

The platform runs on Azure as a closed system, with encryption in transit and at rest, and client data is never shared between customers. Where you need an EU counterparty, contracting runs through TrialAssure B.V. in Eindhoven. Exact region and residency options depend on how your instance is deployed, so we set them out in writing for your engagement rather than stating a single region here — worth settling before you scope a release rather than at contract stage.

Yes. Data processing agreements are available on request, and the DPA is the vehicle that turns the commitments described on this page into contractual terms — purpose limitation, confidentiality, security measures, breach response, sub-processor disclosure, and the term that your data is not used to train public models. For organizations that need an EU counterparty, contracting runs through TrialAssure B.V. in Eindhoven. The sub-processor list ships with the security documentation pack, requested through the Trust Center, so your privacy team can read it before legal review starts, which tends to shorten the negotiation rather than lengthen it.

TrialAssure is GDPR-aligned and HIPAA-aligned, and holds two ISO certifications: ISO 9001:2015 for quality management, certified by BSI under ANAB accreditation (certificate FS 797863, valid to 23 April 2027), and ISO/IEC 27001:2022 for information security, certified by Intertek under UKAS accreditation (certificate 0251375, valid to 18 July 2029). The distinction is worth being precise about: the ISO certificates are independently audited, while GDPR and HIPAA alignment describes how the platform and our processing terms are built to support your obligations as controller. The 27001 certificate is published in the Trust Center, and the wider security documentation pack is available on request for your procurement and security reviewers.

Yes. Every transformation is logged, timestamped and attributable to a named reviewer, and the record is exportable, so the audit response is a file you produce rather than a story you reconstruct. The trail shows what was changed, which method was applied, who reviewed it, and the residual risk score the release was signed off against — the four things an auditor, a DPO or opposing counsel actually asks for. Because the log is generated as the work happens, it does not depend on anyone remembering a decision made months or years earlier, which is where manual processes usually fail.

Manual redaction varies by person and by vendor, leaves an incomplete trail, and rests on judgment you may later have to defend without evidence. One engine applies the same rules to every document, scores the residual risk and records each change, so consistency stops depending on who was assigned the file and how late in the release window it landed. That is what replaces “we believe it’s compliant” with a number and a log. It does not remove judgment: you still set the threshold, define scope and sign off. It moves judgment to the decisions that deserve it, and out of every individual field-level call.

Either. You can license the platform and run releases with your own team, run it alongside our transparency specialists when volume spikes or in-house expertise is thin, or hand the whole package to TrialAssure Services and receive finished, signed-off deliverables. Defensibility does not change with the model: the same engine, the same threshold you set, the same named-reviewer sign-off and the same exportable audit trail in every case. Which model fits usually comes down to release volume and the review capacity you have, so it is worth talking through before you scope the work.