Security & Compliance
How Indelio meets 21 CFR Part 11 and GAMP 5 — the controls your auditor will ask about, and how each is enforced.
The compliance spine is built into the database, so it holds even against someone with direct access.
- ✓ Immutable, hash-chained audit trail: every create, change, and signature is time-stamped and linked to the previous entry. Update and delete are blocked at the database, so nothing can be quietly altered or removed.
- ✓ Two-component electronic signatures: identity plus password, re-verified at the moment of signing — you can only sign as yourself.
- ✓ Segregation of duties, structurally: the author of a record cannot review, approve, or close their own work.
- ✓ Content-hash binding: each signature is bound to the exact record it signed, so any edit afterward visibly breaks the seal.
Only authorized, authenticated members of your organization reach your data.
- ✓ Role-based access control (author, reviewer, approver, QA, admin) enforced server-side on every action.
- ✓ Optional two-factor authentication (TOTP) with step-up at login.
- ✓ Password complexity policy, failed-login lockout, periodic password aging, and idle-session auto-logout (21 CFR 11.300).
Your organization's data is walled off from every other tenant at the database layer.
- ✓ Row-level security scopes every table to your organization — enforced by the database, not just the application.
- ✓ Any tenant secrets (e.g., your own AI key, if you bring one) are encrypted at rest with AES-256-GCM and only decrypted server-side at use.
- ✓ Private file storage with per-record access checks; uploaded files are hashed so their integrity can be verified.
- ✓ Your documents never leave your tenant — even during onboarding. You upload into your own environment and we guide migration remotely; we never receive, hold, or handle a copy of your controlled content.
- ✓ Runs on established, industry-standard cloud infrastructure — Postgres via Supabase, hosting via Vercel.
A risk-based GAMP 5 validation approach, with much of the operational testing already automated and re-runnable.
- ✓ A validation package — Validation Plan, System Requirements Specification, requirements-to-Part-11 traceability, and an automated Operational Qualification, backed by a 1,900+-test suite mapped control-by-control to what it proves.
- ✓ IQ and PQ protocols ready to execute: Installation Qualification against your deployed instance, and Performance Qualification of your real processes under your own SOPs — executed and signed with independent quality review.
- ✓ A public release register: every release records what changed, which modules it touches, and our assessment of whether a controlled function was affected — so you can risk-assess a release against the state you qualified, rather than re-testing blind or not at all.
- ✓ An independent validation consultant helps you qualify it — no $20–50k implementation invoice.
Security is verified on every change, not once a year.
- ✓ An adversarial test suite that actively tries to forge a signature, inject an audit entry, tamper a record, or cross the tenant boundary — and asserts each is blocked.
- ✓ Static analysis (Semgrep) on every push and scheduled dynamic scanning (OWASP ZAP).
- ✓ Dependency vulnerability monitoring (Dependabot).
The Part 11 controls above are built and tested today. Operational Qualification evidence — the automated suite — ships with every plan; Installation Qualification we execute against your instance as its own line; Performance Qualification is yours to execute and sign, because it runs your processes under your SOPs — a system is only “validated” once that is executed against your instance. A SOC 2 program is on our roadmap and pursued when a customer requires it. We’d rather tell you exactly where we are than overstate it — happy to walk your quality team through any of this in detail.
Qualifying a system once is the easy half. The ongoing cost is deciding, every time the vendor ships, whether anything changed that touches what you qualified. Most SaaS vendors leave you to guess. Our release register is public and records, per change, what it was, which modules it affects, and whether a controlled function moved.
That classification is our assessment of what we changed — an input to your decision, never a statement that your system is still validated. That conclusion stays yours.
You should ask that. We’re a young company, and you’d be putting your controlled documents, signatures, and audit trail on us. Here is what actually protects you — none of it requires trusting us.
- ✓ You are never locked in. No multi-year contract. Month-to-month if you want it — so the most you ever have at risk is the time since your last invoice, not a three-year commitment.
- ✓ Your records are yours, and they are portable. Indelio runs on standard PostgreSQL. Your documents, signatures, and full audit history export in human-readable form whenever you ask — not as a favour, as a feature.
- ✓ Nothing is ever deleted. The store is append-only and enforced at the database, so your history is complete and intact by construction — there is no state in which your records quietly disappear.
- ✓ The validation package is yours to keep. The Validation Plan, SRS, traceability matrix, IQ and PQ protocols, and your executed records are documents in your possession. They do not stop existing if we do.
- ✓ Your SOPs are your own. The procedures you adopt are yours under your quality system, not licensed from us.
An established vendor answers this question with their size. We can’t, so we answer it with your exit: no lock-in, portable records, and an immutable history you own. If that isn’t enough for your risk assessment, tell us what would be — we’d rather have that conversation than have you not ask.