SecureDepot — Secure Document Exchange, Purpose-Built for Regulated Research

By TechData Service Company LLC

Elevator Pitch

Tagline: Secure document exchange, built for clinical research — not retrofitted for it.

30-second version: SecureDepot is TechData Service's secure document exchange for clinical research teams — a dedicated channel for sharing protocols, safety data, and DMC packages with sponsors, CROs, and study teams, without email attachments or generic file-sharing risk. Every upload, download, and account action is authenticated, scoped to the right client/project, and captured in a tamper-evident audit trail architected to 21 CFR Part 11 standards — so you always know exactly who accessed what, and when. Every upload is checked for malware before it is stored. It's fast, modern, and built around how a study team actually works: two-way channels, organized packages, automatic notifications, and file version history, all with the compliance rigor clinical trial data demands.

---

Full Overview

TechData Service was founded in 2000, and SecureDepot has been part of our work since we built it in 2008. For nearly two decades it has carried sensitive study documents — protocols, safety data, Data Monitoring Committee packages — between our team and the sponsors, CROs, and DMC members we work with every day. SecureDepot has now been rebuilt from the ground up: the same trusted exchange, hardened for the compliance standards clinical research demands today.

---

Built for the Work You Actually Do

SecureDepot isn't a generic file-sharing tool retrofitted for research. Every design decision starts from how a study team actually works:

• Two-way, role-aware exchange. A dedicated channel for what TechData shares with a client/project, and a separate one for what the client sends back — so a DMC member, a sponsor's biostatistician, and a TechData analyst each see exactly what's meant for them.
• Organized the way your studies are. Optional folders per channel, titled and described "packages" that bundle related files together, so a document set arrives as a coherent unit, not a scatter of individual attachments.
• Nothing gets silently overwritten. Upload a revised file under the same name and SecureDepot keeps it as a new version — the prior one stays in the history, not lost.
• No more "did you see the email?" The moment a package lands in your channel, the right people are notified automatically, in-app and by email — and one click takes you straight to it. Not just to your channel to go find it yourself: the notification opens the right folder and the exact package for you, already expanded, so you land looking at the files themselves.
• Preview without downloading. PDFs and images open right in the browser — no round-trip through your downloads folder for a document you just need a quick look at.
• Picks up where you left off. Work across several clients/projects? SecureDepot opens the one you were last working in when you next sign in. And if a session times out, signing back in returns you to the page you were on, not to the start.
• A guide written for your role. The in-app Manual opens on a guide for your role specifically — not a generic manual you have to decode — alongside short guides everyone can use: how the sign-out timer works, how two-factor sign-in works, how to tell a genuine SecureDepot email from a fake, and answers to "why can't I…?".

---

Security & Compliance, Built In — Not Bolted On

SecureDepot was rebuilt around six principles that matter most when the documents crossing the wire include clinical trial safety data:

Authentication. Passwords are stored with modern, salted hashing (bcrypt/Argon2id), and passwords carried over from the previous system are upgraded to it automatically at their next sign-in. No administrator can view or change your password: new accounts are activated from an emailed link where you choose your own. Two-factor authentication is required for every TechData staff account, can be required of any individual account, and is open to anyone who wants it — an authenticator app (TOTP, the same standard used by major banking and enterprise apps) or a one-time code by email, whichever fits how someone works. Forgotten your password? Self-service reset by username or email, no help desk ticket required — and the response is identical whether or not the account exists, so the reset form itself can't be used to fish for valid usernames or addresses. An unattended session warns you with a countdown and then signs itself out, and an account that is locked or deactivated is signed out on its very next click, not whenever its session happens to expire.

Authorization. Access isn't a matter of which links happen to be visible — every action is checked against your role and your specific client/project assignment on the server, every time, for every request. A user scoped to one engagement can never reach another's documents, regardless of what they might try to guess or type into a URL — including the one-click links in upload notifications themselves: each one is re-verified against your actual access at the moment you click it, every time, not just trusted because it arrived in your inbox. Isolation between clients/projects is built into how the data is stored and fetched, and it fails closed: if an access check were ever missed, the result would be nothing shown, never another client's documents.

Integrity. Every file is checked for malware with ClamAV before it is stored. An infected file is refused outright rather than quarantined — along with the rest of that upload, so no package ever arrives half-complete — and never becomes available to download; administrators are alerted at once. If the scanner can't give an answer, the upload is refused and can be retried, never quietly accepted unscanned. Every create, update, and deletion of a document, folder, user, or client/project record is captured with the exact before-and-after values — not just "something changed," but precisely what changed, by whom, and when. A deleted document isn't destroyed on the spot: it goes to a Trash an administrator can restore it from, and removing it for good takes their password and a stated reason, both on the record. Nothing disappears with a departing user either: an account that has uploaded anything can't be deleted, only deactivated, so the record of who did what stays whole.

Auditability. That trail isn't just logged — it's tamper-evident. Every audit entry is cryptographically chained to the one before it, so any retroactive edit to history, however it happened, is mathematically detectable. Authorized staff can review, filter, and export the full audit trail themselves — no engineering ticket required to answer "who did what, and when."

Availability. Modern, actively maintained infrastructure — current-generation Linux, MySQL, and a supported application framework — replacing components that had run unchanged, and increasingly fragile, for over a decade.

Confidentiality. Every TechData team member with system access operates under a signed confidentiality agreement, as they always have. Every connection is encrypted in transit with TLS.

SecureDepot is architected to the standards of 21 CFR Part 11 electronic-record requirements — attributable, tamper-evident audit trails and documented, testable access controls — because the documents it carries are used to support real clinical trial oversight.

---

What's New

If you've used the previous SecureDepot, here's what's different day to day:

• A modern, responsive interface that works as well on a tablet as a desktop.
• Drag-and-drop upload with progress feedback — no more clicking through a legacy upload form.
• File version history, visible right where you're already looking at the file.
• In-browser preview for PDFs and images.
• Every upload checked for malware before it is stored.
• Deleted folders, packages, and files go to a Trash and can be restored, instead of being gone the moment someone clicks Delete.
• Automatic upload notifications, so you're never waiting on an email that didn't get sent — and clicking one now takes you straight to the exact package, opened and highlighted, instead of just the general channel view. It finds the right place even if that package has since been moved or the folders reorganized, so an older notification never points you somewhere stale.
• A self-service audit log and CSV export for compliance reporting — on demand, not on request.
• Forgot your password? Reset it yourself in minutes — no more waiting on an admin to do it for you.
• New accounts are activated from a secure emailed link where you choose your own password — no more passwords read out over the phone, and no one else ever knows yours.
• A choice of two-factor methods — an authenticator app or an emailed one-time code — instead of one fixed option.
• A warning with a countdown before an idle session signs out, and one click to stay signed in. If it does time out, you get a plain-language note instead of an error page, and signing back in takes you straight back to the page you were on.
• SecureDepot remembers which client/project you were last working in and opens it for you.
• A Manual with a guide for your role, plus short how-to guides every user can read — including one on how to recognise a genuine SecureDepot email.

Everything you relied on is still there: the same two-channel exchange model, the same client/project-scoped access, the same accounts and permissions your team already understands.

---

Questions?

Contact your TechData Service representative to learn more about SecureDepot, or to get set up with access for your study team.

TechData Service Company LLC — founded in 2000; SecureDepot in service since 2008.