Security
Zero-PHI architecture for clinical site tools
Built for CRCs, CRAs, and Site Directors who need fast logistics utilities without uploading kit closets or specimen manifests to a vendor cloud.
Is CRC Toolbox HIPAA compliant?
CRC Toolbox is designed as a Zero-PHI operational utility: you must not enter Protected Health Information. Kit IDs, lot numbers, specimen codes, and de-identified logistics notes stay in your local browser storage only. Client-side processing by design avoids server-side PHI ingestion for these workflows — that is an architecture statement for site IT reviews, not a blanket claim that every institution can skip a BAA. See institutional privacy counsel for your use case.
100% client-side execution
Every utility runs inside your browser. Protocol Ops workspaces (Cohort Kit Tracker, Kit Expiration Tracker, Lab Specimen Workbench, Deviation Assistant, Equipment Calibration, Visit Window Calculator) persist in localStorage on this workstation until you clear them. Clinical Calculators, Renal/Performance, Safety & GCP, and CTCAE Grader run in ephemeral memory only.
Zero remote storage for base tools
Base utilities do not send clinical or logistics inventory to remote servers. The only outbound messages are voluntary waitlist or contact forms — never include PHI in those submissions. Email signups are processed by Formspree, which may set a technical cookie during submission — no tracking or ad cookies are used.
Technical verification (DevTools Network)
During calculation, parsing, FIFO allocation, and CAPA drafting, CRC Toolbox issues zero network fetch requests for tool data. Open DevTools → Network, filter XHR/Fetch, and confirm 0 bytes transmitted for the workflow. This inspectability is intentional for site IT and privacy office reviews.
Browser & transport hardening
Production responses set Content-Security-Policy, X-Frame-Options (DENY), X-Content-Type-Options (nosniff), Referrer-Policy, Strict-Transport-Security, and a Permissions-Policy that limits hardware access. Camera is allowed only for same-origin barcode scan flows when you opt in.
PHI guardrails in free-text tools
Deviation notes and lab paste fields run real-time identifier heuristics (SSN, DOB, MRN, and name-like patterns) so accidental PHI is flagged before export or print.