A biotech round is a set of documented processes pretending to be a handshake. Eligibility is a written test per investor. Tranches turn on regulatory events that arrive as dated documents. The data room holds patient-level data the law calls special-category and trade secrets whose legal existence depends on provable protection measures. Exedra Gate is the rail on which each of those records is produced while the work happens, dated by someone other than the parties.
A reviewer can confirm, with free standard tools, that the documents are unchanged and existed at the stated moment. The timestamp comes from an independent authority.
Each entry below is a published rule with its primary source attached. Which regime a given vehicle or investor falls under is a question for the manager and its counsel, never for a platform.
Showing rules for European Union
The argument on this page does not change with the selection. The citations do.
Every jurisdiction is shown below, grouped and labelled.
The fund-management directive moved under the sub-threshold regime. The fund-management directive’s amendment applies from 16 April 2026, so templates from last year are already out of date.
Clinical material in a data room is special-category data. Health and genetic data sit under a processing prohibition that lifts only on specific conditions, such as explicit consent for specified purposes. The question a dispute asks is not whether the room was secure but on what basis, for what purpose, who saw it, and when.
What stays confidential is exactly what must be actively managed. Since 18 June 2024 the clinical-trials system’s deferral mechanism is gone, so what stays confidential is exactly what must be actively managed.
Milestones arrive as dated documents. A centralised marketing-authorisation assessment runs up to 210 active days to a committee opinion, and the European Commission decides within 67 days of that opinion. Tranche triggers drafted against such events are disputes about documents and dates, not about science.
EMA, evaluation step by step; EMA, obtaining an EU marketing authorisation
The secrecy-measures condition comes from the directive the member states transposed. A trade secret is defined by reference to information subject to reasonable steps to keep it secret by the person lawfully in control of it, and the German transposition is what /life-sciences cites for the constitutive effect of that condition.
The German semi-professional investor is a documented process, not a number. The route requires a commitment of at least EUR 200,000 plus a written risk acknowledgement, an assessment of the investor’s expertise and experience by the manager, and the manager’s written confirmation that the assessment was carried out. Four separate written elements, per investor, that must still exist when someone disputes the categorisation years later.
The elective professional test is evidence too. A client may be treated as professional on request where at least two of three criteria hold: an average of ten significant transactions per quarter over the preceding four quarters, financial assets above EUR 500,000, or at least a year in a capital-markets profession, with a written warning and a written acknowledgement around it.
Below the authorisation line is a regime, not an exemption. A manager running only special funds stays sub-threshold at EUR 100 million of assets under management, or EUR 500 million unleveraged with no redemption rights for five years, and is registered and reporting rather than exempt.
A trade secret exists only while its protection is provable. German law defines a trade secret as information subject to appropriate secrecy measures by its lawful holder; without provable measures there is no secret to misappropriate. Per-viewer access control and a record of who opened which document when are the usual measures, and the usual proof.
The cap table has statutory clocks. A German GmbH files an updated shareholder list without undue delay after a change takes effect, electronically only under a qualified electronic signature, with managing directors personally liable for the failure.
Switzerland runs its own thresholds. Wealthy private clients may opt out of retail protection at CHF 500,000 with the knowledge and experience to match, or at CHF 2 million without, and fund law keys "qualified investor" to those categories.
Switzerland’s new transparency register takes effect on 1 October 2026. Beneficial owners at 25 percent of capital or votes, reported within one month, with supporting documents kept ten years, replacing the old share-law notification articles.
The restriction lands on the communication itself. A person may not, in the course of business, communicate an invitation or inducement to engage in investment activity unless that person is authorised, the content is approved by an authorised person, or an exemption applies.
The exemption stands on a signature and its date. The high net worth individual exemption turns on a statement the individual has completed and signed within the twelve months ending on the day the communication is made, and on the prescribed warning being given with the communication.
The same twelve-month clock runs on the second route. The self-certified sophisticated investor exemption turns on a statement the individual has completed and signed within the twelve months ending on the day the communication is made.
Financial Services and Markets Act 2000 (Financial Promotion) Order 2005 (SI 2005/1529), art. 50A(1)
Admissible, and nothing beyond admissible. In any legal proceedings an electronic signature, and the certification of that signature by a person, are each admissible in evidence on the question of the authenticity or the integrity of the communication or data.
The statutory floor is shorter than the claim window. Accounting records must be preserved for three years from the date they are made by a private company, and for six years by a public company.
A deed sets a twelve-year horizon on the evidence. An action founded on simple contract cannot be brought more than six years after the cause of action accrued, and an action on a specialty cannot be brought more than twelve years after.
Accountability is an evidence duty in terms. Personal data may be kept in identifiable form no longer than is necessary for the purposes it is processed for, and the controller must be able to demonstrate compliance with that and the other principles.
The third limb of the definition is the evidential one. Information is a trade secret only while it is secret, has commercial value because it is secret, and has been subject to reasonable steps in the circumstances by the person lawfully in control of it to keep it secret.
One Act runs two retention clocks of different lengths. Every company must keep copies of members’ written resolutions and minutes of general meetings for at least ten years from the date of the resolution, meeting or decision, and failure is an offence by every officer in default.
A general prohibition with an exhaustive list of exits. It is unlawful for relevant securities to be offered to the public in the United Kingdom unless the offer is of a kind specified in Part 1 of Schedule 1, or a combination of two or more of those kinds.
Public Offers and Admissions to Trading Regulations 2024 (SI 2024/105), reg. 12(1)
Twenty-five years, and every alteration traceable. A sponsor must ensure that any alteration to a document in the trial master file is traceable, and must keep those documents, including documents in electronic form, for at least twenty-five years from the day after the trial concludes, complete, legible and readily available to the licensing authority on request.
Medicines for Human Use (Clinical Trials) Regulations 2004 (SI 2004/1031), reg. 31A(6) and (7)
The Law Commission stated the position, and the formalities survive it. The Law Commission’s statement of the law is that an electronic signature is capable in law of executing a document, a deed included, provided the signatory intends to authenticate it and any formalities for that document are satisfied, and that an electronic signature is admissible in evidence in legal proceedings.
Verification is a document review with a date on it. An issuer relying on Rule 506(c) must take reasonable steps to verify that every purchaser is an accredited investor, and each of the safe harbour methods the rule lists is a document review or a written confirmation with a date attached to it.
17 CFR 230.506(c)(2)(ii), Regulation D under the Securities Act of 1933
Reasonable care is not established without a recorded inquiry. An issuer cannot establish that it exercised reasonable care over disqualifying events unless it made a factual inquiry into whether any exist, and the scope of that inquiry varies with the circumstances.
The duty is triggered by status and it is timed. Where an issuer sells under Rule 506(b) to a purchaser who is not an accredited investor, it must furnish the specified information to that purchaser a reasonable time prior to sale.
A release inside the country is still an export. Releasing or otherwise transferring controlled technology or source code to a foreign person inside the United States is itself an export, treated as an export to that person’s most recent country of citizenship or permanent residency.
15 CFR 734.13(a)(2) and (b), Export Administration Regulations
Handing over the means of access is the controlled act. Technology and software are released by visual or other inspection that reveals them to a foreign person, or by oral or written exchange, and any act causing a release, including through use of access information, needs the same authorisation the export would need.
The operative word is "solely". For a transaction in or affecting interstate or foreign commerce, a signature, contract or record may not be denied legal effect, validity or enforceability solely because it is in electronic form.
15 U.S.C. 7001(a), Electronic Signatures in Global and National Commerce Act
Accuracy, accessibility and reproducibility are the three conditions. Where a law requires a record to be retained, an electronic record meets that requirement if it accurately reflects the information and remains accessible to those entitled to it, for the period the law requires, in a form capable of being accurately reproduced for later reference.
Self-authentication removes a witness, not an objection. A record generated by an electronic process that produces an accurate result, and data copied from an electronic device that is authenticated by a process of digital identification, are each self-authenticating on a certification by a qualified person, so no extrinsic evidence of authenticity is required to admit them.
The audit trail is the control, and it may not obscure what came before. Where FDA rules are met with electronic records, the controls must include secure, computer-generated, time-stamped audit trails that independently record the date and time of the entries and actions that create, modify or delete a record, and record changes must not obscure previously recorded information.
The meaning of a signature is a required field. A signed electronic record must carry, in human readable form, the printed name of the signer, the date and time the signature was executed, and the meaning associated with the signature, such as review, approval, responsibility or authorship.
The signature has to be bound to its record. Electronic signatures and handwritten signatures executed to electronic records must be linked to their records so that the signatures cannot be excised, copied or otherwise transferred to falsify a record by ordinary means.
The retention clock is tied to an event nobody can date in advance. An investigator must retain the required records for two years after a marketing application is approved for the indication investigated, or, if no application is filed or it is not approved, for two years after the investigation is discontinued and FDA is notified.
Six years, from creation or from last effect, whichever is later. A covered entity or business associate must keep the documentation the Security Rule requires for six years from the date of its creation or the date it was last in effect, whichever is later.
An original can be electronic where its integrity is evidenced. Where UAE law requires a document to be submitted or stored in its original form, an electronic document meets that requirement if there is technical evidence confirming the integrity of its information from the moment it was first created in final form, and if it can still present that information whenever it is requested.
The duty is to comply and to be able to show it. A controller or processor must establish a programme to demonstrate compliance with the Law, and must implement appropriate technical and organisational measures to demonstrate that processing is performed in accordance with it, so the obligation is not only to comply but to be able to show it.
Data Protection Law, DIFC Law No. 5 of 2020, Article 14(1) and 14(2)
The record of processing is itself a required document. A controller must maintain a written record of the processing activities under its responsibility, which may be in electronic form, covering at least the purposes, the categories of data subjects and personal data, the categories of recipients including those in Third Countries, and where possible the time limits for erasure.
The record has to exist and to be handed over on request. Each controller must maintain a record of the processing activities under its responsibility, the record must be in writing including in electronic form, and it must be made available to the Commissioner of Data Protection on request.
Data Protection Regulations 2021, sections 28(1), 28(3) and 28(4)
Ongoing integrity, and a process for testing that it holds. Controllers and processors must implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including the ability to ensure the ongoing integrity of processing systems and a process for regularly testing and evaluating whether those measures are effective.
Data Protection Regulations 2021, sections 30(1)(b) and 30(1)(d)
This clock runs the other way: it is a duty to stop. An organisation must cease to retain documents containing personal data, or remove the means of associating that data with particular individuals, as soon as it is reasonable to assume that the collection purpose is no longer served and retention is no longer necessary for legal or business purposes.
Modification is named alongside access. An organisation must make reasonable security arrangements to prevent unauthorised access, collection, use, disclosure, copying, modification or disposal of the personal data in its possession or under its control.
Three conditions, and the list is not exhaustive. A legal requirement to retain a document is satisfied electronically only if the information stays accessible for subsequent reference, the record keeps its original format or a format demonstrably representing it accurately, and the information identifying the record’s origin, destination and the date and time it was sent or received is retained as well.
The written notice limb bites on one branch only. Where a prospectus has been registered and an offer is nonetheless made in reliance on the private placement or accredited investor exemption, the offeror must first have notified the Authority in writing of that intent and taken reasonable steps to inform the offeree in writing that the offer relies on the exemption.
Securities and Futures Act 2001, sections 272B(1)(d)(ii) and 275(1)(c)(ii)
The exemption turns on a running count. The private placement exemption holds only where offers are made to no more than 50 persons within any 12 month period and none of them is accompanied by an advertisement making the offer or calling attention to it, which makes the running count of who was approached, and when, part of what establishes the exemption.
The modal verbs differ inside one clause. Personal information used to make a decision about an individual must be retained long enough to allow that individual access to it after the decision has been made, and information no longer required for the identified purposes should be destroyed, erased or made anonymous.
Personal Information Protection and Electronic Documents Act, Schedule 1, clauses 4.5.2 and 4.5.3
The safeguards follow the information into any format. Security safeguards must protect personal information against loss or theft and against unauthorised access, disclosure, copying, use or modification, regardless of the format in which it is held.
Personal Information Protection and Electronic Documents Act, Schedule 1, clause 4.7.1
Part 2 reaches requirements under federal law. A requirement under federal law to retain a document for a specified period is satisfied by an electronic document only if it is kept for that period in the format in which it was made, sent or received, or in a format that does not change the information, if it stays readable to those entitled to it, and if the information identifying its origin, destination and the date and time it was sent or received is retained too.
Personal Information Protection and Electronic Documents Act, section 37
There is no federal securities regulator to answer to. Canada has no federal securities regulator: the Supreme Court of Canada held in 2011 that the proposed federal Securities Act as then drafted was not valid under the general trade and commerce power, so an issuer answers to provincial and territorial regulators rather than to a national one.
Ledger entries are published in English only, and cite each instrument by its own official name.
An investor who lost money re-reads their own categorisation. The EUR 200,000 route has four written elements; the elective route has a test, a warning and an acknowledgement. The manager who cannot produce all of them, dated before the subscription, argues from memory against a file. Who holds those documents today, and could they show when each one came into existence?
Everyone agrees the opinion arrived. The dispute is which document constituted the trigger, when it was received rather than dated, whether a clock stop moved the timeline, and whether investors were notified in the form the agreement required. Four questions, all answered by records nobody was assigned to keep.
Special-category data in a diligence room needs a basis, a purpose and a boundary. Two years later the question is who accessed the unblinded safety narrative, on what authority, and whether the aggregated version would have sufficed. A generic file share answers none of that; it barely answers who had the link.
Protection that cannot be proven is protection that legally never existed. The defendant's first argument in a misappropriation case is that the measures were not appropriate, and the exhibit that defeats it is a record of controlled, logged, need-to-know access, produced at the time. An NDA alone is a promise, not a measure.
"Without undue delay after the change takes effect" and "within one month of acquiring control" both start from a moment the parties must be able to prove. A transfer whose effective date lives in an email thread starts a clock nobody can locate, against duties with personal liability and ten-year document retention attached.
A syndicate runs the trial data through validated systems and the raise through a mailbox, a document tool, a generic data room and a signing vendor, each with its own clock. The categorisation file, the tranche notice, the access record and the register filing are joints between systems, and the joint is where the proof is supposed to be. Reconstructed afterwards, each record carries the date of its reconstruction, which is precisely what a challenger points at.
On Exedra Gate the syndicate lead, the company, counsel and the investors work inside one system rather than around it. Identity verification, the categorisation file, the data room, versioned documents, subscription papers, signatures and deadlines run in one flow, and each step becomes an entry as it happens: sent, opened, read, signed and independently timestamped under RFC 3161. Nobody writes the protocol afterwards.
Set against the five situations above: the categorisation documents exist as signed, dated artefacts before the subscription they belong to. The tranche trigger is a dated document beside a dated notice with a dated receipt. Access to sensitive material is per-document and per-person, recorded as it happens, so the secrecy measures a trade secret depends on are provable rather than asserted, and the question of who saw the unblinded data has an answer person by person. The effective date a register clock runs from is an entry, not an email.
The boundary is stated, not implied. The manager makes the categorisation decision; the platform records it, with its evidence and its date, and never makes or endorses it. The platform's signature is an advanced electronic signature with an independent timestamp; a filing that requires a qualified electronic signature, as the German shareholder list does, is made by the people the law names, and the room records that it happened. Exedra Gate never holds or moves funds, and no authority supervises or endorses it.
A document is fingerprinted, the fingerprints are chained and signed, and the record carries a timestamp from an independent authority. Years later, a different reviewer runs the same check with free standard tools and confirms the documents are unchanged and existed at that moment.
Rounds outlive tools, and biotech timelines outlive most vendors. The record exports in standard formats, in one shape, and is checked on the holder's own machine with free tools. Deployment, residency and the export are described once, for every sector, on the institutional page: how the rail is deployed.
A workspace per round. Each raise is its own room with its own clocks, its own document versions and its own investor list, held beside the others.
The categorisation files. Identity verified once; the written elements of each investor's categorisation collected, signed and dated before the subscription that relies on them, under the manager's own decision.
The tiered data room. Aggregated material for the wide audience, sensitive material behind narrower doors, every access recorded per person and per document as it happens.
Contracts, tranches and notices. Subscription papers generated in the room and signed on the phone; tranche triggers filed as dated documents beside dated notices with dated receipts.
The export. One evidence pack per round, in one shape, handed to an auditor, a counterparty or a dispute rather than assembled for it, and checked on their own machine with free standard tools.
The compliance rail is live in production today. The mobile app is arriving and is named as arriving wherever it appears. What runs today, in full.
The tests are written, the clocks are statutory, and the disputes arrive years later, aimed at whichever record was kept most casually. A syndicate that prepares answers from the record. Exedra Gate exists for it.
Access is by invitation. A short note on the vehicle and the round is enough; where there is a fit, the walkthrough happens on a live system, using the syndicate's own scenario.
Exedra Gate is a technology platform, not a broker, dealer, custodian, escrow provider, or investment adviser. It never holds, routes, or settles investor funds, does not recommend offerings to investors, and charges no success-based fees on raises. Investor categorisation is decided by the manager or its adviser; the platform records the decision and its evidence and never makes it. The platform's electronic signature is an advanced electronic signature, not a qualified one; filings that require a qualified signature are made by the persons the law names. Records and timestamps attest integrity and existence as of a date, not compliance with any particular regime; that judgment remains with the manager and its counsel.
Regulatory references on this page are orientation, not legal advice: see Sources & verification.