Sovereign storage for clinical trials

The challenge

Modern clinical trials generate data under several simultaneously-applicable regimes. A multi-site Phase III trial enrolling Canadian, US, and EU participants is producing data subject to PHIPA (Ontario), Quebec health-information law, HIPAA (US sites), GDPR (EU sites), TCPS2 (Canadian research ethics), the sponsor's data-handling agreement, and increasingly clinical-AI governance obligations.

The standard pattern — store everything in a hyperscaler region and document residency in the protocol — increasingly fails procurement review at sponsors and REBs. Hyperscaler regional storage doesn't resolve the parent-jurisdiction question. The CLOUD Act reach against a US-controlled provider holding Canadian patient data isn't theoretical anymore; sponsors and ethics boards are starting to ask for architectural evidence.

The clinical-AI overlay makes this harder. RAG over trial records (for decision support, recruitment, or analysis) typically involves sending records to OpenAI or Azure OpenAI — breaching the data-handling agreement before it leaves the building. Sovereign AI requires the entire embedding-to-answer path to stay inside the residency envelope.

The architectural answer

SkyeConnex's architecture answers the four-framework problem with three configuration knobs:

• Per-site jurisdiction policy — Canadian sites get a Canadian allow-list (ca-central-1, OVH Beauharnois, Backblaze Canadian, on-prem MinIO). EU sites get an EU allow-list. US sites get a US-only allow-list. The effective-policy cascade handles inheritance from sponsor to site to participant cohort.
• Zero-knowledge encryption — every patient record is encrypted with a key derived on the investigator's device. The platform cannot read records; sponsor audit yields ciphertext only.
• Sovereign RAG via SkyeGXU — embeddings compute on the site's own GPU, never reaching OpenAI. The Barrista in-app assistant grounds answers in the site's own records.

The signed sovereignty report — dual-signed with HMAC-SHA-256 and ML-DSA-87 — gives the IRB / REB and the sponsor monitoring committee externally verifiable evidence of where every record resided across the trial timeline.

How it works in practice

Site onboarding

The site PI receives a SkyeConnex account scoped to the trial. The compliance preset pack (combining PHIPA / HIPAA / GDPR / TCPS2) is pre-configured by the sponsor's data-management group. Connexions to the site's preferred storage providers are pre-authorised.

Record capture

CRF uploads, source-document uploads, and imaging uploads stream through the SkyeConnex web client or the S3-compatible SkyeBucket gateway (for sites already integrated with Veeam or AWS Backup). The five-endpoint chunked upload protocol handles intermittent network conditions at sites with variable connectivity.

Monitoring and audit

The sponsor monitoring committee receives signed audit reports per site per cycle. The SkyeMap shows real-time residency at participant-record level. Any out-of-policy write is logged, surfaced, and blocked.

Clinical AI integration

Sites running clinical decision support, predictive enrolment, or query-AI plug their existing tools into SkyeGXU's OpenAI-compatible /v1/embeddings endpoint. The application doesn't change; the data stays on-prem.

Closeout and archival

Long-term archival continues to use the same allow-list policy. Cryptographic erasure for participant withdrawals is a single operation. The signed audit log supports retention requirements under GCP, HIPAA, and FDA 21 CFR Part 11.