How It Works — ComplianceGxP

From Your Documents to Audit-Ready Answers

Generic RAG retrieves text. ComplianceGxP understands compliance.

Ingest Your Documents

Upload SOPs, validation protocols, regulatory guidelines, deviations, and CAPAs. Each document is parsed (PDF/DOCX/XLSX/TXT), chunked along pharma-aware section boundaries, and embedded into a private FAISS index isolated per namespace.

SOP · Validation Plan · Deviation · CAPA · Regulatory · Audit

25+ Years of Pharma Expertise, Built In

Each mode is driven by specialised system prompts written from deep GxP experience — encoding how a real validation engineer thinks: which sections of a deviation matter, what a CAPA must contain to survive an FDA inspection, what “risk-based” means in the context of GAMP5 Category 4 software.

Domain knowledge you cannot prompt-engineer in an afternoon

Choose Your Compliance Workflow

Each mode runs a structured workflow — not a generic “chat with your docs” interface. QA surfaces sourced policy answers. Deviation runs 5M analysis with classification. CAPA drafts corrective actions with regulatory traceability. CSV produces protocol outlines aligned to IQ/OQ/PQ.

QA Deviation CAPA CSV

Structured, Sourced, Audit-Ready

Every answer cites the exact document and section it came from, with similarity score. Every query is written to a SHA-256 hash-chained audit log with timestamp, user, mode, and sources. Outputs match the structure your QA team already knows — ready to paste into your QMS.

[Major Deviation] → 5M Root Cause → Actions → Owner
Source: SOP-DEV-042 §4.1 · 21 CFR Part 11 §11.10(e)

Architecture at a Glance

FastAPI service. FAISS vector store. Anthropic Claude for generation. SHA-256-hashed keys. Hash-chained audit log. Hosted on Fly.io in the EU (Amsterdam).

RAG Pipeline

Documents → pharma-aware chunker → local embeddings (all-MiniLM-L6-v2, 384-dim) or OpenAI embeddings → FAISS IndexFlatIP (cosine, threshold 0.3) → Claude generation with mode-specific system prompts.

Multi-Tenant Isolation

Each client gets a separate FAISS index, metadata file, and hash-chained audit log under data/clients/<namespace>/. Per-key tier flags (can_ingest, can_read_logs) enforce least-privilege access.

Validation Package

IQ-CGXP-001 (16 test cases — environment, dependencies, file I/O) and OQ-CGXP-001 (34 test cases — auth, ingestion, all 4 modes, audit log) are automated and run before every release; PQ templates for your own documents. The full package →

Agent-Ready Surfaces

REST API for integration. MCP server endpoint at /mcp/ for direct connection from Claude AI, Claude Code and agent workflows over the Model Context Protocol. SHARP headers (Standardized Healthcare Agent Remote Protocol) for healthcare agent interop.

Try It on Your Own Documents

A pilot gives your team the full product on your own private document library: every mode and the tamper-evident audit trail, for an agreed period. Scope and price on request.

Request a Pilot

Need data segregation on your own infrastructure? On-premise on request →

What ships in the box:

QA Mode

Sourced Q&A · citations

Deviation Mode

5M RCA · classification

CAPA Mode

Corrective action drafts

CSV Mode

IQ / OQ / PQ outlines

GAMP5 Validation

IQ/OQ protocols · PQ templates

Audit Trail

Hash-chained · per query

MCP Server

Claude AI & Code interop

SHARP

Healthcare agent protocol

Managed service, on-premise or validation support?
See Pilot & Pricing →

Ready to try this with your own documents?

Start with a pilot for your pharma, biotech or CDMO team: ComplianceGxP grounded in your actual SOPs, validation protocols and regulatory guidelines.