Compliance and security

Every control, explained. Every claim, tested.

Qualsted supports compliance with 21 CFR Part 11 and EU GMP Annex 11. Here's exactly how each control works, how it's verified, and what remains your responsibility.

21 CFR Part 11 and Annex 11

The technical controls, clause by clause.

Clause	How Qualsted meets it
§11.10(a) · Annex 11 §4	Validation evidence with every release. Requirements traced to automated tests, installation checks and deviations, in a report for your validation file.
§11.10(b) · Annex 11 §8	Accurate and complete copies. Server-made PDFs and CSV exports, stating who printed them and when; every export is audited.
§11.10(c) · Annex 11 §7, §17	Records protected for their whole life. No hard deletes anywhere: the app's database role can't delete. Records are archived; published versions and files are kept.
§11.10(d) · Annex 11 §12	Access limited to authorized people. Unique accounts, two-step sign-in, single sign-on, and permission checks on the server for every request.
§11.10(e) · Annex 11 §9	Secure, computer-generated, time-stamped audit trails. Append-only in the database, with server time; before and after values for every change.
§11.10(f) · Annex 11 §15	Operational sequence checks. Review workflows enforce signing order; records lock in review and after publication.
§11.10(g)	Authority checks. Only designated signers from the step's group can sign; only managers change structure; only admins manage people.
§11.50	Signature manifestations. Printed name, date and time, and meaning, shown wherever the signature appears, including printouts.
§11.70	Signature and record linking. A SHA-256 hash of the signed content is stored with each signature; any later difference is flagged.
§11.100 · §11.300(a)	Unique to one person. Accounts are never deleted and emails never reused; vendor support accounts are separate and can never sign.
§11.200	Signature components. A fresh password, or a fresh single sign-on confirmed by the identity provider, at the moment of signing.
§11.300(b)–(d)	Password and misuse controls. NIST 800-63B password rules; five failed attempts lock the account and alert admins at once; lost authenticators are reset by an admin.

Beyond the FDA

The same controls, in the words of your standard.

Quality and lab standards ask for controlled documents and trustworthy records. Here's where Qualsted's controls answer them.

Standard	What it asks, and how Qualsted supports it
ISO 9001 §7.5	Control of documented information. Review and approval before release, versions with history, protection from unintended change, and access by permission.
ISO 13485 §4.2.4 · §4.2.5	Control of documents and records. Approved, versioned documents; records kept legible and retrievable, with changes identified. Also the basis of the FDA's QMSR.
ISO/IEC 17025 §7.5 · §8.4	Technical records and their control. Every change traceable to the previous value, the person and the time; records protected and kept.
AS9100 · IATF 16949 §7.5	Documented information and retention. Controlled records kept for their retention period: nothing is ever hard-deleted, only archived.
21 CFR 117 Subpart F	Food safety records. Records made at the time of the activity, with the date and time and the signature of the person who did it.

Your auditor judges your quality system as a whole: these are the record-keeping controls Qualsted provides toward it.

Validation package

Supplier evidence you can put in your validation file.

Each release is checked by the full automated test suite and documented in a validation report, so your computerized system validation can focus on your intended use.

Requirements catalogue mapped to Part 11, Annex 11, NIST 800-53 and HIPAA 164.312
Operational qualification: every requirement traced to the tests that verify it
Installation qualification: read-only checks of the hosting itself
Deviations listed, checksums for tamper evidence, sign-off by our QA

Aligned with a risk-based, GAMP 5 and FDA CSA approach: automated, repeatable evidence rather than paper scripts.

validation-report.pdf · traceability

Operational qualificationPASS

ID	Requirement	Tests	Result
ACC-06	Lockout and alerting	2	PASS
AUD-01	Audit trail append-only	4	PASS
SIG-01	Credentials at signing	2	PASS
DAT-01	No hard deletes	7	PASS
PLT-04	Hosting safeguards	14	PASS

Security

Defence in depth, from the network to the record.

Hosting

Amazon Web Services, United States
Database in a private network with no internet access
Standby database in a second data centre

Encryption

TLS 1.2+ for everything in transit
Encrypted at rest with managed keys that rotate
Each company's files and secrets with its own key

Isolation

Each company's data walled off by the database itself
Even an admin can't reach another company's records
Verified by automated tests every release

Sign-in

Two-step sign-in, required by default
Single sign-on: OpenID Connect or SAML
Sessions end when idle, and after 12 hours

Protection

Web application firewall and rate limits
Account lockout, with admins notified at once
Strict security headers on every response

Resilience

Point-in-time restore for 35 days
Daily and monthly encrypted backups
Every infrastructure action logged, threats monitored

Your data, your keys

You decide who can read your data, including us.

Bring your own key

Use a key from your own AWS account for your files and secrets. If you disable or revoke it, they become unreadable to everyone, us included, within minutes.

Support access only with approval

Our engineers request access with a reason. Your admin approves it for a level and a time window, or denies it, and can withdraw it at once. Support accounts can never sign records or grant themselves anything, and everything they do is in your audit trail.

Shared responsibility

Clear about what we do, and what stays with you.

Qualsted provides

The technical controls above, built in and tested every release
Secure, monitored, backed-up hosting
The supplier validation package and release documentation
Support with configuration and your validation

You remain responsible for

Validating your intended use (performance qualification)
SOPs, training, and your electronic signature policy (§11.10(i)–(k), §11.100(c))
Who gets access, and periodic review of it
Your own risk assessment and change control

Compliance FAQ

Straight answers.

Is Qualsted “Part 11 certified”?

There's no such certification for software. FDA doesn't certify systems; compliance is the result of the system's controls together with your procedures and validation. Qualsted provides the controls and the supplier evidence that they work.

Do you have SOC 2 or ISO 27001?

Not yet. An independent penetration test and a SOC 2 audit are on our roadmap, and we'll share the reports with customers when they're complete. Until then we're glad to answer your security questionnaire in detail and walk your team through the controls. See the trust center for what's available today.

Can we audit you as a supplier?

Yes. We support supplier qualification, including questionnaires, documentation review and audits, as part of onboarding.

Can we store health information?

Qualsted is built with the HIPAA Security Rule's technical safeguards in mind (access control, audit controls, integrity, authentication and encryption). Talk to us before storing protected health information, so we can agree the right terms first.

What happens to our data if we leave?

Your records, files and audit trail are yours. You can export any table as CSV or PDF at any time, and when you leave we hand over a complete copy of your records, files and audit trail. Nothing is deleted while you're a customer.

Guides

The rules in plain English.

Regulations

For your quality team

Walk your QA lead through every control.

We'll show the audit trail, signatures and validation report on a live workspace, and answer your supplier questionnaire.

Book a compliance walkthrough