How we protect your dossier.

Your dossier is the most sensitive intellectual property your company shares with a regional partner. We show you exactly what we do with that information at each phase of the relationship, and what happens if you decide not to move forward with us.

Three levels, each with explicit rules.

Not everything your company shares with IRIS has the same sensitivity, and not everything requires the same level of protection. We operate under three disclosure levels, each with clear rules about what information is shared, who has access, and what legal commitments apply. You control which level the relationship operates in.

Level 1 — Public engagement

Company name, general product category, and countries of interest. No proprietary information, no NDA required.

No signature

Level 2 — Under NDA

Molecule names, patents, timelines, competitively sensitive detail. A mutual NDA before you share anything.

NDA signed

Level 3 — Under MSA

Your complete dossier, under a Master Services Agreement with explicit legal terms.

MSA signed

Level 1 — Public engagement.

What we share and receive at this phase is information both sides consider appropriate for initial conversations, without additional legal obligations. Your company name, general product category (for example, "prescription cardiology" or "point-of-care diagnostic devices"), and countries of interest. We share our service structure, regional capabilities, and generic regulatory timelines by category. All of this happens without signing an NDA. It's simply qualified conversation.

Key point: At this level you haven't committed any proprietary information. And we haven't asked you to. If we don't move forward, there's no trace.

Level 2 — Under NDA.

When the conversation requires depth — specific molecule names, specific patents, launch timelines, situations with current distributors, or any competitively sensitive information — we sign a mutual NDA before you share any detail. The NDA is two-way: it protects you from us, and protects us from you.

Under NDA:

All communication occurs between people specifically named in the agreement, not broad distribution
Documents are transmitted through end-to-end encrypted channels, not conventional email
Shared files reside in a dedicated space only the authorized team can access
Upon completing the evaluation, if you decide not to move forward, all shared information is destroyed under verifiable protocol within 30 days

Key point: The NDA is not a formality. It's an operational commitment that changes how we handle your information from the moment it's signed.

Level 3 — Under MSA.

When we decide to work together, we sign a Master Services Agreement that establishes the commercial relationship. At this level, your complete dossier — CTD, technical dossier, protocols, regulatory documents from other markets, manufacturing specifications — enters our work environment under explicit legal terms.

Under MSA:

Your information is processed by designated teams in each market where the project operates
We share your information with regulatory authorities only for the purposes authorized in the MSA
We never share your information with other clients, nor with partners not authorized by you in writing
Upon terminating the relationship, you decide what information is retained (for ongoing license-holding regulatory obligations) and what is destroyed

Key point: The MSA is where trust becomes verifiable compliance. We internally audit compliance with these clauses each quarter.

Where your dossier physically lives.

Queen Creek, AZ

Quito, Ecuador

Physical original documents from dossiers that require certified translation, notary seals, or physical signatures are processed at our offices in Queen Creek, Arizona (headquarters) or Quito, Ecuador (regional operations), in access-controlled spaces with entry logging. Physical originals are returned to the client via courier service with tracking; we never retain physical originals beyond the time necessary for immediate processing.

How your documents live digitally.

AES-256 encryption at rest

TLS 1.3 in transit

Access segmented by project

All digital information is stored in cloud infrastructure under AES-256 at-rest encryption. Transmissions occur under TLS 1.3. Access is segmented by project: the team working with your dossier has no visibility into another client's dossier. We audit access monthly and maintain access logs for 24 months.

Who has access to your information.

The team working on your project is named in the MSA. That team has access to the dossier. No other IRIS member — including executive leadership — has routine access to specific client information. New members who join the project during its development are added in writing to the MSA, with your prior approval.

All team members sign individual confidentiality agreements at the time of hire, with obligations that survive termination of employment. These agreements are verifiable if you request them as part of your due diligence process.

If you decide not to work with us, it should cost you nothing to have talked.

The most common case in the industry — and the most frustrating for the manufacturer — is discovering that sharing information with a potential provider left you in a vulnerable position if the relationship doesn't advance. Signing an NDA with us implies exactly the opposite: if after evaluation you decide not to move forward, all shared information is destroyed under verifiable protocol within 30 days, without partial retention or hidden conditions.

This commitment is especially important for manufacturers evaluating exit from a current distributor relationship. The conversation with us is confidential and without consequence if you decide not to proceed, and the current distributor will not be notified or contacted by us under any circumstance until you explicitly authorize.

Talk to us. Under NDA from the first technical conversation.

If your next conversation requires technical depth about your dossier, we can sign a mutual NDA before that conversation, without friction. Request it directly on the form or mention it in your message.

Talk under NDA