blueSource

Cryptographic eSource for clinical trials

Secures clinical trial data collection with cryptographic signing and tamper detection, producing verifiable electronic source records.

Module — in active build

Request a pilot conversation Read the manual

Runs locally · CLI or web UI · Ed25519-signed receipts · no cloud account required

Who it's for

Clinical trial sponsors, CROs, and research integrity teams.

What it is not

blueSource does not judge whether a value is clinically right. BOUND means the value on the form matches a signed source version — nothing more. It does not read free text: anything without a coded, signed source is left blank for a person to enter. And the key it trusts today is this install's own, not a company-wide root — a monitor verifying a bundle is verifying that this install signed it. It is not a trial management system, not an electronic data capture platform on its own, and not a replacement for existing trial infrastructure.

Screens

blueSource binds each value on a case report form to a signed version of the source record it came from, so a study monitor can verify the binding without ever reading the chart. The four screens below follow one synthetic study from the roster, into a populated form, to the discrepancy queue that catches anything short of a clean bind, and on to the monitor's view — where every value is withheld and verification still succeeds.

blueSource Study Roster: three enrolled subjects for protocol BH-2091-A, each row showing visit, window, per-form binding health counts (bound, unbindable, superseded, or cannot-certify), and Active status, with a Reseed (idempotent) button. — Synthetic study data
Study roster — three enrolled subjects, each with a visit, its window, and binding health per form: 8 of 9 items source-bindable, then how the bindings stand — BOUND, UNBINDABLE, SUPERSEDED or CANNOT-CERTIFY. The ninth item on every form is an investigator narrative that has no coded, signed source and is always entered by hand.

Open a subject's visit to see the form itself.

blueSource Form Population screen for a Labs and Concomitant Medications form at Visit 2, Week 6: rows for Hemoglobin A1c, Glucose, Creatinine, Sodium, Potassium and Baseline ECG QTc, each with its populated value and a binding chip — five BOUND, one CANNOT-CERTIFY, one UNBINDABLE — plus concomitant-medication rows marked BOUND and an investigator narrative field left blank and marked NEEDS HUMAN ENTRY. — Synthetic study data
Form population — values populate deterministically from coded, signed source records; nothing is generated by a model. Five lab values are BOUND, one is CANNOT-CERTIFY because its source signer isn't in the trusted root, and Baseline ECG QTc is UNBINDABLE because no signed source exists for it — every gap is typed, never left blank without saying why.

Anything that is not a clean BOUND goes to the discrepancy queue, never a silent pass.

blueSource Discrepancy Queue screen listing 5 open items across three subjects: a Hemoglobin A1c row marked CANNOT-CERTIFY because its source signer is not in the trusted root set, three Baseline ECG QTc rows marked UNBINDABLE because no signed source exists and the field requires permanent manual entry, and an Active medication row marked SUPERSEDED because the source changed after binding, each with an Investigate action. — Synthetic study data
Discrepancy queue — every failed binding and every source that changed after it was already bound, across the whole site. The SUPERSEDED row is the sharpest case: a subject's active medication was bound to Lisinopril 10 mg, and the source record has since changed to resolve to 20 mg — flagged, not silently updated.

From here, the monitor sees none of these values — only whether each binding holds.

blueSource Remote Source Verification screen: four counters — 6 verified and bound, 0 supersede flagged, 1 unbindable, 1 cannot-certify — above a bundle table for one synthetic subject's Week 6 visit in which every value column reads WITHHELD, each row showing a receipt hash, a verdict chip and a verification timestamp; the two rows without a binding read not source-bound; a lock note states this monitor account has no chart access and no launcher login and receives only the signed export bundle. — Synthetic study data
What the monitor sees. Values withheld, hashes and verdicts shown, verification succeeds anyway — the monitor checks the cryptography, not the chart. The two items without a binding say so in words instead of showing an empty pass.

Status, measured

Demo build (v1) complete with core cryptographic signing, receipt generation, and verification tools.

Not yet true: No clinical trial deployment. No real trial data processed.

A signed receipt proves what blueSource ran and recorded; it does not prove an underlying real-world claim is true. blueSource does not approve, deny, recommend, pay, retract, or alter anything a named human is responsible for deciding.