Validation & Trust

You Validate Your Use. We Give You What You Need.

Under GAMP 5, EU GMP Annex 11 and 21 CFR Part 11, the regulated company validates its own use of a system. The supplier provides documentation the company can assess and rely on.

Where ComplianceGxP stands today: it is validation-ready, not validated. Specifications, supplier SOPs and IQ/OQ test protocols are written, and the automated IQ/OQ tests run before every release. No qualification has yet been executed and signed under an approved protocol. Validation for your intended use is done by your organisation, in your environment — and I can support your team through it.

What's in the Package

Two sets of documents with two owners: what describes the product (ours) and what describes your use (yours, from our templates).

Supplier documentation · LLMOps.Pro

Functional specification (FS-CGXP-001)
Design specification: architecture, data, security, hosting (DS-CGXP-001)
Supplier SOPs: development & release, change control, hosted service operations
Installation qualification protocol, 16 test cases (IQ-CGXP-001)
Operational qualification protocol, 34 test cases, with evidence reports (OQ-CGXP-001)
Traceability matrix, functions to tests (TM-CGXP-001)
Signed change records for every change to the product

Customer templates · completed in your QMS

User requirements specification (URS)
Risk assessment and supplier assessment
Validation plan and configuration specification
Performance qualification (PQ) with your own documents
Traceability matrix, requirements to risks to tests
Validation report and release for use
SOPs for use and for administration & periodic review

Supplier documents are versioned drafts until approved. The package is available on request and from the app's Evidence tab, as PDF or Word; each copy carries the SHA-256 of its source, so you know exactly which version you reviewed.

How Validation Works With ComplianceGxP

Risk-based and proportionate: you decide which supplier testing to leverage and what to re-test.

Assess the supplier with your own questionnaire or audit, using the specifications and SOPs.
Define your intended use: write your URS and risk assessment from the templates.
Configure and record the system in a configuration specification. The app's evidence bundle gives you the actual configuration values.
Execute your PQ with your own documents and process. On a self-hosted installation you also execute IQ and, as your plan decides, OQ.
Release and review: write the validation report and SOPs, then file the evidence bundle at each periodic review and assess every supplier change notice.

Where Your Data Goes

The first question every QA lead asks — answered step by step.

Step	What happens	Leaves the system?
Upload	Your documents are stored in your own namespace, with a dedicated index, on an encrypted volume	No
Indexing	Embeddings are computed by a local model in the same process	No
Query	Your question, plus up to 16,000 characters of the most relevant passages from your documents, is sent to the LLM provider to write the answer	Yes — to Anthropic
Audit trail	Every query and answer, including refused queries, is written to a SHA-256 hash-chained log	No

Sub-processors

Provider	Role	Location & terms
Fly.io	Hosting of the managed service	Amsterdam (EU), single machine, encrypted volume
Anthropic	Language model (Claude) that writes the answers	Standard commercial API terms: API data is not used to train models. No zero-data-retention agreement is in place.

What this means for you: on the hosted pilot, use non-confidential or sanitised documents. For confidential documents, ComplianceGxP can run on your own infrastructure with your own LLM agreement — on request, set up and qualified together with you.

Security controls

HTTPS only; certificates managed by the hosting provider
API keys stored as SHA-256 hashes; the raw key is shown once
One namespace and index per client; per-key permissions
Encrypted data volume; secrets kept outside the code and image
The service runs in an isolated micro-VM
Daily volume snapshots, kept 5 days

Environments

Today the hosted service at compliancegxp.llmops.pro is a development and pilot environment. It is for evaluation, not for GxP decisions.

Before any customer uses ComplianceGxP for GxP work, separate validation (VAL) and production (PROD) environments will be created, deployed only from tagged, tested releases.

Using ComplianceGxP Correctly

Four boundaries by design. Your URS, risk assessment and SOP for use should reflect them.

Every output is a draft

AI answers can differ in wording for the same question. Every output needs review by a qualified person before regulated use; CAPA and CSV drafts are marked DRAFT — REQUIRES REVIEW by the system itself.

ComplianceGxP drafts, your QMS signs

There are no electronic signatures or approval workflows in the app, and it never writes to your systems of record. Approval, signature and document control stay in your DMS/QMS.

Retrieved text goes to the LLM provider

Relevant passages from your documents are sent to Anthropic with each question. On the hosted pilot, use non-confidential or sanitised documents; for confidential content, run ComplianceGxP on your own infrastructure with your own LLM agreement.

The hosted pilot is for evaluation

Until the validation and production environments are in place, the hosted service is for evaluation and feedback, not for GxP decisions.

Open items and roadmap. Like any supplier, we have open items: tests to extend, procedures to complete, environments to qualify. The supplier documentation package includes the complete list, with the impact, owner and planned action for each one. Ask for it as part of your supplier assessment.

Contracts & Regulation

Data Processing Agreement: in preparation; it will be in place before any paid engagement.
EU AI Act: our risk classification and article-by-article position — read the AI Act page.
Privacy: privacy policy ↗