CRAs and study managers log their work and time against studies, sites and sponsors. You see how much effort each study takes, which tasks are late, and the hours per sponsor, in one place.
For CROs, SMOs and hospital research units. Runs in the browser, nothing to install. In English and Turkish.
For the day-to-day operations of clinical research: who is on which task, how many hours went to which study, and what you report to each sponsor.
A CRO's data carries the trust of its sponsors, sites and participants. Here is how we handle it, including what we do not have yet.
Every record belongs to one organization. The database returns only your organization's rows to a signed-in user (PostgreSQL row-level security). The rule lives in the database, not the app, so even a bug on a screen cannot show another organization's data.
Six roles: system admin, organization admin, study manager, CRA, finance and site user. A study manager sees only assigned studies; a site user sees only their site. Nobody can grant themselves a role or move themselves to another organization.
Before any change ships, the database is built from scratch in an empty environment and dozens of access checks run for each role: do two organizations stay apart, can finance create a study, does an inactive account see anything. If one fails, the change does not ship.
Patients are stored under a study-level pseudonymous code only; there are no fields for names, ID numbers or phone numbers. The subject code on a time entry is free text and is not linked to a patient record.
Every insert, update and delete on studies, sites, investigators, tasks, time entries, users and roles is written by the database with who changed what and when. Organization admins see their own organization's log.
All connections are encrypted with HTTPS and the database is encrypted at rest. Passwords are stored one-way; nobody, including our team, can read them. Admin actions run on the server after re-checking the signed-in user's rights. Two-step sign-in with an authenticator app is required for administrators, and admin rights do not work in the database without the second step.
| Standard | Enterprise | |
|---|---|---|
| Database | Shared infrastructure, row-level separation per organization | A database and keys of your own |
| Region | EU — Ireland (eu-west-1) | You choose the region (for example the EU) |
| Domain | Masatio address | Your own domain (portal.yourcompany.com) |
| Your own servers | No | On request |
Every row is tied to your organization and the database returns only rows of the signed-in user's organization. Automated tests check this on every change. If you want physical separation, the Enterprise plan gives you a database of your own.
Masatio Clinical runs on Supabase, built on PostgreSQL. Data is stored in the European Union, in Ireland (AWS eu-west-1). On the Enterprise plan you can choose another region. The list of infrastructure providers we use is an annex to the data processing agreement.
Only a pseudonymous code. The app has no fields for patient names, ID numbers, dates of birth or contact details. The key that links codes to people stays at your site.
You are the controller for the data you enter; Masatio is the processor. We sign a data processing agreement (DPA) on request. We process data only to provide the service; we never sell it or use it for anything else.
Our team has no account in your organization. If support needs us to look at your data, we do so only with your written permission and only for that request.
Only people you invite. If you invite a site with the site user role, that person sees only their own site's records. There is no sponsor user role yet.
You do. You can ask for all of your data as Excel or CSV at any time. When a subscription ends, we hand your data over and delete it from the system within 30 days.
No. Masatio Clinical is for work, time and operations tracking; it is not a validated system and has no electronic signatures. Keep using your EDC and eTMF systems for regulated clinical records.
Yes. Each person can turn it on under Account security with an authenticator app such as Google Authenticator or Microsoft Authenticator. It is required for administrators: their admin rights do not work without the second step.
On the Enterprise plan we install on request. The platform is built from open-source components.
Write to info@masatio.com. We reply within one working day and share the plan for the fix with you.
In 20 minutes we look at how your team tracks work and time today and what you report to sponsors.
We import your studies, sites and team from Excel. The app opens with your organization's name and colour.
Your team starts logging time the same day. At the end of the first week we review the reports together.
Tell us about your organization, team size and how many studies you run; add your security questions too.
We usually reply the same working day.