See what is checked,
required, and independently reviewed.
Clear status, plain language, and no borrowed compliance badges.
Checked in the public demo
Synthetic-data workflows only- People approve every quality decision
- AI answers show their evidence
- Audit-ready evidence package examples
- Clear deadline and applicability rules
- AI cannot close records or approve work
Required before production use
The complete control set is in the PRD- Customer data separation and enterprise sign-in
- Encryption and secure key management
- Retention, complete export, and deletion
- Backup, restore tests, and disaster recovery
- Secure development, monitoring, patching, and incident response
- Data location, vendor oversight, and a clear AI data-use policy
HIPAA-enabled deployment profile
12 testable requirements are now in the PRD; this public demo remains no-PHI- Confirm the HIPAA role and PHI data flow for each customer
- Sign a business associate agreement before any PHI is processed
- Test access, audit logs, encryption, backup, incident, breach, and vendor controls
- Keep the public demo and every non-BAA environment free of PHI
Independent review status
Current status, without unearned claims- SOC 2 Type II Planned; no report yet
- ISO/IEC 27001 Planned; not certified
- WCAG 2.2 AA Design target; formal audit pending
- HIPAA-regulated use / BAA Requirements defined; not currently offered for PHI
We provide evidence.
Customers approve their use.
Part 11 depends on the record, intended use, applicable FDA rule, and operating controls. QMS Studio can provide technical evidence, but each customer must test and approve its exact production setup.
Part 11 control designIdentity, signature meaning, audit trail, complete copies, and retentionIn the PRD
EU GMP Annex 11Separate therapeutic-biotech expansion; not part of the current device and IVD PRDSeparate scope
Customer validationIntended use, risks, traceability, tests, deviations, and release approvalRequired
Primary references: 21 CFR Part 11 · 45 CFR Part 164 · HHS BAA guidance
Review the validation packageKnow what came from a source, a rule, or the AI.
- 1Source factThe exact passage and version
- 2System calculationThe rule, inputs, result, and time
- 3AI suggestionThe model, evidence, uncertainty, and limits
Accept, edit, and reject actions are logged
AI stops when evidence is missing or conflicts
AI cannot approve root cause, reportability, disposition, CAPA, effectiveness, or closure
Production requirement: customer data is not used to train shared models
HIPAA-regulated use and BAAs are not currently offered. Use synthetic data only. A designated production environment, signed BAA, tested safeguards, and operating evidence are required before PHI can be processed.