Frequently asked questions

An AI-native electronic quality management system (eQMS) for small life-sciences teams — 21 CFR Part 11 and GAMP 5, with seventeen connected modules (document control, change control, complaints, CAPA, corrections & removals, nonconformances, design controls/DHF, human factors (HFE/UE), risk, post-market surveillance, training, suppliers, calibration & maintenance, audits, management review, quality policy & objectives, and projects/validation) that all share one immutable audit trail.

Small and mid-size medical device companies, early-stage and pre-commercial biotech and pharma, and CDMOs — teams too small for Veeva and tired of the price tag and long rollouts of the incumbents. If you're running quality on spreadsheets or a shared drive, this replaces that with a real, compliant system.

Published, transparent pricing starting at $9,900/year — no "contact sales to see a price." See the pricing page for all tiers and a year-one cost comparison against the incumbents.

Yes. Every plan includes the validation package — Validation Plan, System Requirements Specification, Part 11 traceability, IQ and PQ protocols, and 1,900+ automated tests. Your User Requirements Specification is your own document — it captures what your processes need — and an independent validation consultant helps you author it where needed and works with you to execute Installation Qualification against your instance and your Performance Qualification under your own SOPs. PQ is yours by definition — it demonstrates your processes, on your system, run by your trained people — and we support you through it rather than a separate $20–50k implementation invoice.

Days, not the 3–9 month rollouts the incumbents run. Every customer gets guided onboarding (remote by default) so you're configured correctly and don't have to figure out compliance on your own.

Yes. AI-assisted migration ingests your legacy documents (PDF/Word), proposes the metadata, and a human reviews before anything commits. Legacy documents are imported as "migrated" with their prior approval recorded — never with a forged electronic signature — and your quality lead signs a single migration verification.

A fair question, and you should ask it. We're young, and you'd be putting your controlled documents, signatures, and audit trail on us — so here's what protects you, none of which requires trusting us. You're never locked in: no multi-year contract, month-to-month if you want it, so the most you ever have at risk is the time since your last invoice. Your records are portable — Indelio runs on standard PostgreSQL and your documents, signatures, and full audit history export in human-readable form whenever you ask. Nothing is ever deleted, because the store is append-only and enforced at the database. And the validation package — Validation Plan, SRS, traceability matrix, IQ and PQ protocols, and your executed records — are documents in your possession that don't stop existing if we do. An established vendor answers this with their size; we answer it with your exit.

You own your data. Pricing is month-to-month if you want it — no multi-year lock-in — and the platform runs on standard Postgres, so your records are portable. We win by being worth keeping, not by trapping you.

The compliance controls are enforced in the database, not bolted on the surface: an immutable, hash-chained audit trail; two-component electronic signatures re-verified at signing; segregation of duties enforced server-side — in most modules separating the steps, so whoever signs one gate cannot sign the next, and in a set of single-signature records separating the author from the approver; and content-hash binding so any edit after signing breaks the seal. See the Security & Compliance page for the full picture.

Row-level security scopes every table to your organization at the database layer, so tenants are isolated by the database — not just the app. Access is role-based with optional two-factor, idle-session timeout, and failed-login lockout. Any keys you bring are encrypted at rest.

AI assists (drafting SOPs, redlining against the regulations, migrating documents) but is never the final approver — a human signs every record. AI inputs are sanitized against prompt injection, and you can bring your own AI key so your AI usage runs under your own data terms.

Straight answer: the Part 11 controls are built and tested today, and no platform arrives validated. Operational Qualification evidence — the automated test suite — comes with every plan. Installation Qualification is executed against your instance by us, priced as its own hourly line, because most of it reads the hosting and database consoles a tenant does not have. Performance Qualification is yours: it runs your processes, under your SOPs, with your people, so you execute and sign it and we never can — a system is only "validated" once that's done against your instance. A SOC 2 program is on our roadmap, pursued when a customer requires it. We'd rather tell you exactly where we are than overstate it.

Yes — a 30-day free trial with the full platform, not a limited demo. Thirty days is deliberate: segregation of duties means you can't approve your own document, so genuinely evaluating it needs a second user and a full author → review → approve cycle with e-signatures. Anything you build during the trial carries over if you convert, so you never redo the work. Separately, we're taking on three Founding Partners who get the platform free for 60 days, with onboarding and Installation Qualification included at no charge, in exchange for real use and feedback.