Ask anyone who has worked in a biobank or contract research organization about their chain-of-custody system, and the answer is usually embarrassing. A shared spreadsheet. A binder at the freezer. Maybe a LIMS that logs transfers but lets anyone edit the record after the fact. For an industry handling human DNA samples under HIPAA, GDPR, and 21 CFR Part 11, that is a compliance disaster on a slow countdown.
DNAChain is a purpose-built platform that applies cryptographic hash chaining to every sample custody event. Every registration, transfer, processing step, and consent change gets SHA-256 hashed and linked to the previous event. Alter any record and the chain breaks instantly, firing an integrity alert in seconds. It is the kind of audit infrastructure that regulators expect but that most labs have never actually had.
The platform launched this week on Product Hunt, built by genomics researchers and infrastructure engineers who, according to founder Ramon Randall, lived the audit-prep nightmare too many times. The result is something genuinely different from generic compliance tooling: a single source of truth for every specimen, with one-click regulator-ready PDF exports signed against the full hash trail.
Key Features of DNAChain
Tamper-Evident Sample Lineage
Every custody event is hashed with SHA-256 and cryptographically chained to the one before it. There is no gap in the sequence and no silent edit. If someone modifies a record after the fact, the chain link breaks and the platform surfaces a mismatch alert immediately. This is not a soft audit log that trusts database permissions. It is mathematical proof of the unbroken sequence.
Dynamic Consent Engine
Consent in genomics research is not a one-time checkbox. Participants withdraw. Scope changes. Studies end. DNAChain handles versioned, scope-aware consent with automated expiry alerts and instant withdrawal cascades across all linked samples. When a donor revokes consent, every downstream record is updated in real time, with the event itself added to the immutable chain.
Real-Time Global Custody Tracking
A live custody map shows dual-signed transfers as they happen. Each shipment manifest is committed as a single hash-chain entry, so there is never ambiguity about where a sample is, who last handled it, or whether the handoff was properly countersigned. This is particularly useful for multi-site studies and international transfers.
Signed Audit Exports
When a regulator asks for documentation, DNAChain generates a regulator-ready PDF signed cryptographically against the full hash trail. Anyone with the report can independently verify it. No calls to the vendor, no manual reconstruction, no explaining why records look different in two systems.
API and LIMS Integrations
The platform offers a REST API, webhooks, and LIMS connectors, so labs can extend the audit chain into existing pipelines without replacing their entire stack. The chain wraps your workflow rather than forcing you to abandon it.
A Monday Morning Audit Request: How DNAChain Handled It
Dr. Priya Menon manages a clinical genomics lab at a mid-sized CRO. On a Monday morning at 8:45 a.m., she received an email from a sponsor requesting a full chain-of-custody report for sample cohort DNA-2024-00417, covering all transfers over the previous six months. Under her old system, that meant pulling transfer logs from a shared Excel sheet, cross-referencing paper manifests from three different sites, and spending most of the morning reconciling timestamps that did not quite match.
With DNAChain, Priya opened the sample record, clicked the verify function, and watched the platform re-hash every event in the chain: registered, processed, stored, transferred, all four links confirmed intact. She clicked export. A signed PDF audit report was ready in under a minute, covering every custody event with actor, location, timestamp, and cryptographic proof of integrity.
She sent it to the sponsor by 9:15 a.m. No calls to other sites. No reconciliation. No explaining discrepancies. The sponsor’s compliance team confirmed the report was independently verifiable and accepted it without further questions. That is the concrete difference DNAChain makes on an ordinary workday.
How DNAChain Builds the Hash Chain
Step 1: Submit
A custody event is captured with actor identity, location, and timestamp, either through the web UI, the REST API, or a LIMS connector. Nothing requires manual transcription after the fact.
Step 2: Hash
DNAChain computes a SHA-256 digest deterministically from the canonical record, including the previous event hash. This is what forms the unbroken chain: each new event is mathematically linked to everything before it.
Step 3: Chain
The new hash is appended to the per-sample audit chain and the organization-wide ledger in sub-second time. The commit is immediate and irreversible.
Step 4: Verify
At any point, DNAChain re-hashes the live record and walks the chain forward. A single broken link surfaces tampering. The verification can be triggered manually, run on every export, or scheduled continuously through live integrity monitoring.
DNAChain Pricing
- Free: $0/month, up to 10 active samples, 1 user, basic consent tracking, community support. No credit card required.
- Starter: $199/month, 3 seats, 500 samples, all core features, email support.
- Professional: $599/month, 10 seats, 5,000 samples, all core features, BAA included, priority support.
All plans include immutable audit logs, role-based access, and SOC 2-aligned controls. Annual billing saves two months.
Who Should Be Using This
If your lab, biobank, or CRO still tracks DNA sample custody in a spreadsheet or a LIMS with editable records, DNAChain is worth a serious look. The free tier lets you run a real pilot with up to 10 samples, no card needed. For labs preparing for regulatory inspection or managing multi-site studies, the Professional plan’s BAA and priority support make it a practical fit. Start at dnachain.bio and see what a cryptographically verifiable audit chain actually looks like in practice.
