A clinical trial has a peculiar personnel problem. Some of the people who need its software work for someone else. The sponsor owns an application. A research site employs the investigator. A contract research organization coordinates another piece of the work. Everyone belongs to the same study. Nobody belongs to the same IT department.
- Exostar supplies a shared identity for clinical research collaborators.
- SAM gives users one login for connected, approved applications.
- Sponsors keep authority over permissions. The identity can travel; access must be granted.
That organizational gap is where Exostar Life Sciences makes its living. Its Secure Access Manager, usually shortened to SAM, handles registration, authentication and account management across a community of research partners. The ambition is wonderfully mundane: let the investigator get into the correct system and get on with the job.
First, someone had to trust a rival
The idea has an unlikely ancestor. Exostar began in 2000 as a cooperative effort by BAE Systems, Boeing, Lockheed Martin, Raytheon and Rolls-Royce. These businesses needed to coordinate work across company boundaries while protecting information. A supplier network contains plenty of collaboration, and plenty of reasons to be careful about it.
Pharmaceutical research presented a recognizable pattern. By 2013, Merck was using Exostar’s identity technology for EngageZone, its external collaboration platform. That year, EngageZone won the Information Security Executive North America Health Care Project of the Year award. Exostar supplied the identity and access layer beneath the collaboration.
The useful insight was that a person should not have to become a brand-new digital person every time a partner relationship begins. Merck’s innovation fund put $5 million into Exostar in 2014 and another $10 million into its healthcare and life sciences business in 2015. The shared identity idea had a customer willing to help finance it.
A passport with very particular visas
SAM’s central distinction is between proving who someone is and deciding what they may use. Those are separate jobs. A shared credential can establish an identity. The owner of a clinical application still decides whether that identity belongs inside its system, and with which permissions.
Think of it as a passport whose holder still needs the right visas. An investigator can reuse a trusted identity across participating organizations without gaining universal admission. Exostar’s Life Sciences Identity Hub supplies the connections; SAM authenticates the person and applies the access decisions. Delegated administration lets authorized teams manage users closer to the work.
The applications remain distinct. A 2015 agreement connected Veeva Vault to the hub, allowing single sign-on and supporting account provisioning. Vault continued handling content and clinical documentation. Exostar handled entry. The arrangement captures its place in the market: a service joining other services, with expertise in the trust between organizations.
The spreadsheet reaches its limit
In Exostar’s Q2 2025 case study, an unnamed top-ten pharmaceutical company described managing access through emails, spreadsheets and lists sent to application vendors. The coordination process struggled as research partnerships expanded. Its clinical operations manager’s verdict was plain:
“It was very tedious manual work.”
Clinical Operations Manager
Anonymous pharmaceutical customer, Exostar case study
The company chose SAM, highlighting its ability to work across application vendors. Exostar reported 25% faster onboarding of site users, an 86% reduction in passwords managed and 50% faster responses to user-access audit queries. Those are results from one vendor-published customer account. They describe administration and access, and should not be read as equivalent reductions in an entire trial’s duration.
For operations teams, the record of access matters after the first login. Who approved this researcher? Which systems could they enter? When should that access expire? Exostar’s onboarding guidance describes permissions scoped to study, role and organization, with automatic revocation when a project ends or a user becomes inactive. Reporting gives administrators a way to review that history. The service therefore has two audiences: people trying to reach their applications, and people responsible for explaining why they were allowed in.
The network is part of the product
Exostar’s public support directory names Amgen, AstraZeneca, Bristol Myers Squibb, MSD, Novo Nordisk, Pfizer and Sanofi among its life sciences partners. Its SAM materials advertise more than 122 connected applications and a community spanning over 130 countries. A July 2026 company article describes more than 920,000 users across 36,000 organizations.
Scale matters here for a practical reason. If a researcher’s identity is already recognized, another sponsor can grant access without starting every part of registration again. A new connection can benefit existing participants. That makes the breadth of participating sponsors and applications part of what the customer buys.
A general enterprise identity platform, or an internally built system, offers another route. The buyer’s comparison should include the work of connecting external partners, administering permissions and keeping records. Exostar’s specialist proposition rests on having already assembled a clinical research community. A feature checklist alone misses that distinction.
The bill includes the work around the software
This is business software delivered through the cloud, with organizational purchasing handled through sales and integration support available. Exostar stated in its October 2023 SCOPE Europe announcement that site users received single sign-on access without fees. For sponsors, the economic question includes the staff time spent creating accounts, resolving access problems and preparing audit responses.
The parent company has also changed hands. Thoma Bravo completed its acquisition in 2020; Arlington Capital Partners completed its purchase from Thoma Bravo in November 2023. Those transactions concern Exostar as a whole, including its other regulated-industry businesses. They should not be mistaken for standalone life sciences fundraising rounds.
Even a shared identity needs housekeeping
The limits become visible in a small support instruction. Lilly’s guide warns that an email address changed in Exostar must match the address in connected applications. A mismatch can prevent login. Federation depends on consistent records as well as connections.
For a prospective buyer, that suggests a concrete starting point: inventory the applications, identify who approves access, and establish how permissions end when someone leaves a study. A shared login cannot compensate for missing integrations or careless authorization. The useful lesson travels beyond pharma: reduce repeated identity work, keep access decisions explicit, and measure the waiting you remove. Clinical research has enough difficult questions. Getting through the door should be a tractable one.