Saama

Models are the engine of the core modules, inside a platform and services business that carries value without them. Smart Data Quality uses models to find data discrepancies and draft queries and a generative co-pilot to write data quality checks; Source to Submission uses models to map raw data to the CDISC SDTM standard; the Clinical AI Agents added in September 2025 run across study start to submission.

Around them the company sells data ingestion with more than 40 connectors, review listings, discrepancy tracking, a statistical computing environment and visualization, and a services arm covering data platform modernization for life sciences and, through Astraa, other industries. The modules above do not exist without the models; the data platform and services do.

Review is built into each module, and the agents' own limits are not published. The privacy notice says a person must review and approve every model output and that any action in the platform is human driven and approved. The modules show how: generated queries are approved by a reviewer, each SDTM mapping carries a confidence score for a user to accept or reject, and generated data quality checks are tested and approved before production.

The Clinical AI Agents, announced in September 2025, are described as working on partial autonomy with human oversight while capable of extensive independent reasoning, planning and execution. What the agents may do without approval, the confidence level at which a mapping is routed to a person, and how the two descriptions fit together are not published.

The approach and training sources are named; the models and their versions are not. The company reports more than 90 to 100 models trained for life sciences and says it has developed and fine-tuned its own large language models for clinical data.

It names what trains several of them: the co-pilot on the company's historical library of data quality checks, Source to Submission on a customer's previous study data and ongoing user decisions, and Query Anomaly Detection through ongoing fine-tuning. Source to Submission shows a confidence score for each mapping. The base models behind the fine-tuned language models, model documentation, and how versions are managed or customers told of a change are not published.

The host is named; the model layer is not. The privacy notice names Amazon Web Services as the platform's host, in US data centers, and the security page says the platform runs on AWS infrastructure and services. The company describes its models as its own and its language models as fine-tuned in-house, but does not name the base models or say whether any processing reaches an outside model provider; its services arm separately builds on Amazon Bedrock and Azure AI Studio for clients. No sub-processor list is published.

A named customer and vendor reported percentages, with no method behind them. Pfizer has used the company's data review automation since 2020, starting with its COVID-19 vaccine trial, and expanded the agreement across its portfolio.

The company reports that customers cut query identification and generation time by as much as 90 percent, study data transformation time by up to 50 percent, and time from data entry to analysis by more than 35 percent, without attributing the figures to a study or giving a method. Its product page illustrates a review of 2,615 queries falling from 1,177 hours to 130 without naming the study.

A Source to Submission case study from an unnamed top 10 pharmaceutical company reports 25 percent time savings and 70 percent automatic mapping accuracy. Everest Group rates the company a leader, an analyst assessment. Company researchers publish on language models and biomedical text, not on these products' performance. Scale (more than 1,500 studies at over 50 sponsors) describes use, not benefit.

Customer data trains some models, and the boundary between customers is not stated. The privacy notice (effective 25 Apr 2024) says the company processes pseudonymized trial participant data as a processor for sponsors and contract research organizations, keeps personal information as long as reasonably necessary or as agreed by contract, and may use anonymized data indefinitely.

Source to Submission models can be trained on a customer's previous study data and are described as learning from previous mappings and user inputs with each new deployment; the co-pilot is trained on the company's own library of historical data quality checks; the agents use continuous training. Nothing says whether what is learned from one sponsor's data reaches models serving another, a live question with more than 50 sponsors, some running competing programs, on one platform. No retention schedule is published. Nothing is published on safety engineering: guardrails, hallucination handling or how a safety event is handled.

The company states it acts as a business associate, and a substantive privacy notice reaches the service; no agreement is published. The privacy notice (effective 25 Apr 2024) says the company is a processor for sponsors and contract research organizations, handles pseudonymized trial participant data, and where it processes protected health information does so as a business associate under the relevant agreement, binding subcontractors to the same terms.

It also sets out GDPR, UK, Swiss, US state and Indian obligations and the HIPAA rights it will help clients meet. Most trial data reaches it under subject identifiers from sponsors rather than from provider records. Which instrument governs a given customer's data, a data processing agreement or a business associate agreement, is left unstated.

Controls are described in detail with nothing independent behind them. The security and compliance page describes an information security program aligned to ISO/IEC 27001:2013, 21 CFR Part 11 and ICH E6, an external chief information security officer, AES-256 encryption at rest and in transit, multi-factor authentication, endpoint detection, a security event platform, web application firewalls, and application security testing by the company's own product security team.

Alignment is not certification: no SOC 2 report, ISO/IEC 27001 certificate, HITRUST certification or independent penetration test is named, and the data privacy and security white paper sits behind a form. The platform holds trial data for more than 50 sponsors.

No device claim is made, and the products are scoped as trial data management. The output is submission content: SDTM datasets and tables, listings and figures go into filings, so electronic records and data integrity rules apply. The security page says the information security program is aligned to 21 CFR Part 11 and ICH E6, and describes audit trails, separated validation environments and a secure development life cycle.

Checks written by the co-pilot are tested automatically by dry run and unit tests and then approved by a reviewer, so a person stands between generated code and production data, though the tests themselves are generated. No validation summary or qualification package is published.

Responsible AI is committed to in policy, with no evaluation published. The privacy notice (effective 25 Apr 2024) and the security page say the company follows evolving AI rules, naming the 2023 US executive order on AI (rescinded in January 2025), Canada's proposed AI and Data Act and the EU AI Act, and that humans review and approve model outputs.

The Query Anomaly Detection page says ongoing fine-tuning reduces false negatives, validated with comprehensive metrics; the metrics are not published. The question that matters for automated data review is where it looks: a detector can be accurate overall while querying some sites, regions, source systems or therapeutic areas more than others, and that pattern shapes the dataset a regulator sees. Nothing published shows query or anomaly rates by site or source, or results across the populations in the trials reviewed.

Outputs pass review before use; nothing stands behind them. The privacy notice says a person must review and approve every model output and that actions in the platform are human approved. Smart Data Quality presents generated queries for a reviewer to approve; Source to Submission gives each suggested mapping a confidence score for a user to accept or reject; checks written by the data quality co-pilot are dry-run and unit tested automatically, then approved by a reviewer before production.

The security page describes user access logs and audit trails. The only accuracy figure is 70 percent automatic mapping accuracy out of the box, from an unnamed top 10 pharmaceutical customer, with no method or denominator. No warranty, indemnity or remediation commitment for model output is published. Submission datasets and tables built with these tools go into regulatory filings, so an error surfaces in a document the sponsor certifies.

No clinical record integration, and the trial systems it connects to are not named. This is sponsor side clinical data software, so the systems that matter are the ones its buyers run. Data Hub claims more than 40 pre-built connectors and file ingestion from any source, Source to Submission outputs the CDISC SDTM standard, and the agents are said to integrate with the company's study platform or any existing platform. No data capture, trial management or laboratory system is named, no connector list or interface documentation is published, and the SDTM case study is from an unnamed customer.

Residency is committed for the platform; isolation and the agent path are open. The privacy notice (effective 25 Apr 2024) says the platform database sits in Amazon Web Services data centers in the United States, that staff of the company and its clients may reach data remotely from other regions (the company has offices in the United States, India and the United Kingdom), and that transfers from the EU, UK and Switzerland use standard contractual clauses and transfer impact assessments.

The security page says production runs in multiple data centers. Agents can be deployed on the company's study platform or onto a sponsor's existing systems, and where inference runs in the second case is not stated, nor is isolation between sponsors on the shared platform.

The company publishes no price, but the way it sells is clear from its material. Enterprise agreements with pharmaceutical and biotechnology sponsors and contract research organizations, sold as platform software and as customized solutions and services, with agents offered as modular additions to a sponsor's existing platforms. A services weighted engagement prices by project and headcount while platform licensing scales with studies or users, and the site does not say which model a given purchase falls under.

Coverage is named and validated for part of it. The clinical platform covers sponsor-side development from study design and startup through conduct, biometrics and submission, and the company also sells commercial, medtech and provider-side products (revenue cycle management, care coordination, hospital orchestration) that sit outside the trial scope this listing describes. The data review automation is supported by Pfizer's use since 2020; the mapping and agent products rest on an unnamed customer case study and company statements.