metroliq
Every feature · 522 capabilities

The whole platform, itemised.

What each module actually does, as built. No roadmap items on this page — if it is listed, it is in the product today.

Calibration & uncertaintyCertificates & DCCQuality management (QMS)Documents, training & auditsInstruments & hands-free captureScheduling & intervalsMaintenance (CMMS)Enterprise asset management (EAM)Manufacturing execution (MES)Field serviceParts & inventoryService pipeline & clientsCustomer portalAI builders & provenanceIntegrations, API & automationCompliance, validation & securityWorkspace, command center & administration
Calibration & uncertainty

Calibration & uncertainty

Every calibration is a numbered event that carries its own points, readings, reference standards, environment and decision rule — and evaluates conformity live, with a full GUM budget per point. Metrology Lab tooling adds ITS-90 SPRT and thermocouple reference functions, loop and process calibration with hysteresis, the full AIAG MSA-4 suite and NCSLI RP-1 / ILAC-G24 interval analysis, all e-signed onto the asset. A barcode/QR scan gate on perform, standard selection, receiving and crib custody, plus a WYSIWYG label designer with PDF/ZPL output, keep physical identity tied to the record.

Events and readings

  • Event lifecycle draft → performed → approved, with reject-to-draft, void and recompute
  • Points and readings with as-found and as-left, per point
  • Per-point uncertainty contributors
  • Reference standards and environment as signed parts of the record; environment locked after approval
  • Sequence and aggregate point kinds, including balance departure quads with run-consistency checks
  • Guided bench job workspace with stage jumps: standards, environment, measure, decision

Uncertainty (GUM / JCGM 100, 101)

  • Standard uncertainty per distribution: normal, rectangular, triangular, U-shaped, Type A
  • Welch–Satterthwaite effective degrees of freedom and coverage factor from the t-table
  • Correlated inputs via a correlation matrix (Cholesky, positive-definiteness checked)
  • Sensitivity coefficients derived symbolically from the measurement equation with a numerical cross-check
  • Monte Carlo propagation (JCGM 101) with a reproducible seed, 10 k – 2 M trials, shortest coverage interval and asymmetry reported
  • Uncertainty study library from published guides; evaluate at any point in range; e-signed approval; HTML report; publish as a CMC line
  • Expanded U rounded to two significant figures on the certificate; TUR and PFA use the unrounded value

Decision rules (ILAC-G8, Z540.3, JCGM 106)

  • Simple acceptance, guard-banded accept, guard-banded reject, PFA target
  • TUR / TAR from the reference standard's typed per-point accuracy, not a guess
  • Specific-risk PFA and PFR, and conformance probability, per point
  • CONDITIONAL wording states that the specification is met but the result is not accepted under the rule, with the probability of non-conformance if treated as accepted
  • Zero-width tolerance or missing nominal yields INDETERMINATE rather than a false pass

Studies and MSA

  • Gage R&R (AIAG) studies
  • Drift and QC control charts per asset; intermediate checks due list
  • Suggested calibration points from the asset's specification, with a wrong-instrument flag when they are far off the asset's capacity

Temperature, loop, MSA & intervals

  • Callendar–Van Dusen and ITS-90 SPRT coefficient sets fitted from calibration points, stored e-signed on the asset, with a resistance-to-temperature converter
  • NIST ITS-90 reference functions for all eight thermocouple types (K, J, T, E, N, S, R, B) with cold-junction compensation and per-asset deviation tables
  • Loop and process calibration with five-point up and down runs, per-direction hysteresis, terminal and best-fit linearity, zero and span trim recorded as the adjustment
  • The full AIAG MSA-4 suite beyond Gage R&R: bias, linearity, stability (X-bar/R) and attribute agreement with Fleiss' and Cohen's kappa, with PDF reports
  • NCSLI RP-1 / ILAC-G24 family interval analysis: pooled reliability, Wilson confidence bounds, reaction-method and target-reliability recommendations, one-click e-signed bulk apply
  • ISO 17025 §7.8.2 adjustment disposition on every event, printed on the certificate; OIML R76 / USP <41> balance qualification with eccentricity, repeatability, linearity and minimum weight

Scan gating & labels

  • Scan gate (off, warn, require) for calibration perform, reference-standard selection, service-order receiving and tool-crib checkout/checkin: no matching physical scan, no action; every match or mismatch logged with expected and scanned codes.
  • WYSIWYG label designer: drag and resize text, barcode, QR, logo and line elements bound to live asset fields; renders to PDF (Code 128 and QR) or ZPL II for thermal printers.
  • Print jobs queue for a printer-bridge agent and never fabricate a print confirmation.

Content packs & migration

  • Ten instrument-family content packs (6½-digit DMM, clamp meter, pressure gauge and transmitter, temperature probe, USP balance, ISO 6789 torque wrench, ISO 13385 caliper and micrometer, ISO 8655 pipette, RF power sensor, flow meter) install a measurement form, an uncertainty-budget skeleton and a procedure in one step. The budget contributors are placeholders that must be replaced with your own certificate and characterisation data before accredited use; the install check only proves the budget computes a finite expanded uncertainty and TUR.
  • Migration importers for Fluke MET/TEAM, IndySoft, Beamex CMX (CSV and XML) and Qualer with documented column mappings and a dry-run reconciliation before writing; Fluke and Transcat certificate PDFs ingested with the original certificate number preserved.

Send-outs, repairs, loaners & witnessed calibration

  • Subcontracted (send-out) calibration from the order line: the vendor must hold an approved or conditional calibration supplier qualification, enforced by the same gate that blocks purchase orders (409, not a warning); outbound and return legs reference a real shipment or a typed consignment number, never a generated one.
  • The subcontractor's certificate is ingested from a Fluke/Transcat text-layer PDF, a DCC, or keyed by hand, and only becomes a workspace certificate after an e-signed endorsement; it prints "performed by <lab>, accreditation <n>, endorsed by <us>" and is marked outside the endorsing lab's accredited scope unless a per-vendor assessment says otherwise. Send-out cost is a separate line in job costing.
  • Found-out-of-tolerance items branch to a repair estimate the customer authorises or declines in the portal (timestamped, audited); a declined repair cannot close without an e-signed statement of non-conformance, and customer-wait days are reported apart from lab days.
  • Loaner pool: loanable assets lent against a service order with custody through the scan gate, due-back digests, rental billed from real price-book rates; an out-of-calibration loaner is refused at issue.
  • Customer-witnessed calibration: witness name, organisation and on-site acknowledgement signature on the event, printed on the certificate and declared not to be a Part 11 signature; a per-customer policy can block approval until recorded.
  • Traceability-chain report walks unit under test → reference standards → their calibrations to the terminal declaration and names every break (no calibration record, standard overdue on the day used, chain ending in text); included in the accreditation assessment pack.

Reference standards & traceability

  • Coefficient sets for sensor conversions are preferred when electronically signed; an unsigned set is reported as such and refused outright for GxP laboratories, where the requirement is on by default.
Certificates & DCC

Certificates & DCC

Approved calibrations issue a numbered certificate rendered from your template — HTML, PDF and Digital Calibration Certificate XML from the same data — with the decision rule, the standards, the environment and the provenance printed on it.

Issue and render

  • Issue from an approved event; sequential numbering from the tenant prefix
  • HTML, PDF and DCC XML renders from one template shape
  • Values rounded to the significant figures of the uncertainty; results to U's decimal place
  • Decision-rule statement, coverage statement, scope statement, traceability statement, results-relate-only-to-the-item statement
  • Received date, condition on receipt and amendment history printed
  • Historical imported certificates render with a visible 'historical record — migrated' statement

Digital Calibration Certificate

  • DCC XML export with administrative data, items, results, expanded uncertainty, coverage factor and probability, influence conditions
  • DCC import and parse with D-SI unit mapping; imported certificates land in the asset's history
  • Conformity per result carried into the DCC, including CONDITIONAL

Corrections and verification

  • Amendment (ISO/IEC 17025 §7.8.8) with reason; supersedes / superseded-by kept on both revisions
  • Revocation with reason
  • Public verify page: valid, superseded, revoked or under review; recommended recalibration date and in-date flag
  • Record hashes and electronic signatures listed on the certificate

Delivery

  • Certificate bundles and per-order certificate packages
  • CSV export of the register; QR label sheets
  • Customer notification on issue; a failed notification stays visible as a failed row
  • Report builder with twelve block types, live-data bindings, preview, and AI reconstruction of an old certificate layout

DCC validation & signing

  • Every DCC is validated against the official PTB DCC 3.2.0 and D-SI 2.1.0 schemas before it leaves the lab; several schema defects in the existing generator were found and fixed along the way.
  • DCC XML can be signed (XMLDSig, RSA-SHA256) and independently verified, with tampering detected; certificate PDFs get a detached CMS/PKCS#7 signature verifiable with standard tools.
  • The verification certificate is published at a well-known URL, and a lab can upload its own key and certificate so signed artefacts carry its identity; the certificate chain is disclosed as self-signed until a CA-issued one is uploaded.
  • Schema validation reports any XSD construct it could not evaluate as a warning with fully_checked=false instead of passing silently, and attribute values are checked; the subset validator is cross-checked in CI against libxml2 over a corpus of real and deliberately broken certificates.
Quality management · QMS

Quality management (QMS)

CAPA, NCR, deviations, complaints, controlled documents, training, audits, risks, change control, vendors, methods, proficiency testing — one records framework with real numbering, a status machine, versioning and e-signature gates. Change control now runs impact assessment through to an e-signed notification package, supplier qualification and SCARs run through an isolated supplier portal, and a medical-device pack adds design history, ISO 14971 risk and complaint reportability.

Records framework

  • CAPA, NCR, deviation, complaint, controlled document, training, audit event, audit programme, risk register, change control, vendor and vendor agreement, method register, org roles and deputies, impartiality risk, confidentiality agreement, proficiency testing / ILC, document review campaign
  • Real numbering per type, status machine, versioning, e-signature gates per transition
  • Unknown fields on a quality record are rejected, not silently dropped
  • Editing content in a signed state rescinds the signatures and audits the fact

CAPA and nonconformance

  • Escalation NCR / deviation / complaint → CAPA carrying asset and customer forward, linked both ways
  • CAPA effectiveness checks with a due / overdue effectiveness board
  • Out-of-tolerance impact review queue and clearance; recall impact walked across everything the instrument measured
  • AI-drafted investigation and CAPA (five-whys, containment, correction) recorded in the provenance ledger
  • One-step transition matrix on NCR, deviation, CAPA, complaint and change control — no jumping from open to closed
  • Closure gates: NCR needs a disposition, deviation a root cause and disposition, complaint an investigation and response
  • Effectiveness checks are e-signed; a closed CAPA cannot receive a new check without reopening
  • An NCR already escalated to an open CAPA cannot be escalated twice
  • Audit entries carry the before and after value of every changed field

Documents and training

  • Controlled documents with named approvers, versioning, periodic review and review campaigns
  • Controlled-copy print; obsolescence cancels assigned training
  • Training with AI-drafted comprehension quizzes, attempts, acknowledgement and a training matrix
  • Technician authorization per discipline (§6.2.5) can be required before performing

Audits, accreditation and risk

  • Audit programme, audit readiness self-check, assessment-pack export, transition pack
  • Accreditation lifecycle: assessments, findings, responses, renewals; accredited scope and CMC lines authoritative at perform
  • FMEA on risks, PT/ILC evaluation with En and z scores, method validation, vendor scorecards
  • QMS analytics, QC report, technician analytics, AI-drafted ISO §8.9 management review as a controlled document draft

Change-control impact

  • Automated impact discovery: a change's description, affected items and record links surface the documents, training, work instructions, methods, recipes, in-process batches, equipment, suppliers and customers it touches, for the assessor to confirm
  • Optional AI-drafted impact assessment with reasons per candidate; always a draft the assessor applies, never auto-saved
  • One implementation task per confirmed impact; e-signed completion for revalidation and requalification work; e-signed, reason-required waivers
  • Server-enforced gates (assessment complete, tasks resolved, effectiveness verified, package issued) apply identically to the guided UI and to direct API calls
  • One-click notification package PDF with impacts, tasks and evidence, signatures and distribution list, plus a release notification to every affected trainee and task owner
  • A Change Control Board shows every change by state with overdue-task counts

Medical-device quality

  • Design history file with a live traceability matrix: every user need → input → output → V&V link tracked, gaps surfaced automatically, transfer blocked until the matrix is clean and every design review is e-signed closed
  • ISO 14971 hazard analysis with a per-tenant configurable severity × probability matrix, residual-risk re-evaluation and a generated Risk Management File PDF
  • Complaint reportability assessment (suggestion only, never auto-final) with FDA 30/5-day and EU MDR 15/10/2-day deadline clocks, plus FDA eMDR (XML/JSON) and EU MIR (JSON) export; submission stays manual, tracked by status and acknowledgement reference
  • Annual Product Quality Review assembled from real batch, deviation, complaint, CAPA, change-control and calibration-OOT data, with editable conclusions and e-signed sign-off
  • DMR index and DHF export tie approved documents and change controls to the design record

Supplier quality

  • Approved-supplier lifecycle: qualify vendors per category (calibration, parts, software, service) with risk rating and requalification date; purchase orders to a non-qualified vendor are blocked or warned by policy
  • Supplier corrective action requests: issue → supplier response → review → verification → e-signed close, with a mandatory verification note
  • A separate supplier portal with its own login and session, isolated from every lab route, where vendors answer SCARs with evidence, complete qualification questionnaires and upload certificates with expiry tracking
  • Incoming inspection against purchase orders: a rejection opens an NCR and optionally a SCAR, linked to the vendor
  • Live supplier scorecard from on-time delivery, incoming reject rate, SCAR count and response time
Documents · training · audits

Documents, training & audits

Procedures, work instructions, SOPs and forms with named approvers, versions and periodic review — linked from the procedure field of every calibration and work order, and tied to the training of the people who do the work. Controlled documents can now carry their own Word or PDF source file with automatic renditions, redlines and binders, and training is organised into role-targeted curricula with an automated gap-and-assignment engine.

Document control

  • Numbered, versioned controlled documents with named approvers and e-signed approval
  • Periodic review with due dates and review campaigns across sets
  • Controlled-copy print with stamping
  • Obsolescence cancels assigned training
  • Data reports can be published as controlled documents

Training and competence

  • Training records with AI-drafted comprehension quizzes and recorded attempts
  • Acknowledgement and a training matrix per person and per document
  • Technician authorization per discipline, required at perform when the policy is on

Audits and accreditation

  • Audit programme and audit events with findings and responses
  • Audit-readiness self-check and assessment-pack export
  • Accreditation assessments, findings, responses and renewals
  • Accredited scope and CMC lines; service-capability catalog by category and level

Training curricula

  • Role-targeted training curricula: bundle required documents, courses and external items, target by built-in or custom role, with per-item recurrence and due windows
  • The assignment engine diffs required items against completed training and creates what is missing on curriculum save, on document revision and on a periodic sweep
  • Versioned course quizzes: every edit creates an immutable version and each attempt records which version it was graded against; three failed attempts flag the trainer through the rules engine
  • E-signed equivalency for prior or external training evidence; e-signed transcripts (JSON and PDF) per person; users × curricula gap heat map
  • Retraining on document revision targets only the people whose curricula reference that document; tenants without curricula keep the assign-everyone behaviour
  • A reusable competence check endpoint other modules call before authorising work

Controlled documents as files

  • Upload a Word or PDF file as a controlled document's source; text and formatting are extracted automatically for search, diff and rendition
  • Every rendition PDF carries an appended signature manifest (who signed, what it meant, when) and an UNCONTROLLED-IF-PRINTED watermark
  • Word-level redline comparison between any two document revisions, viewable as JSON or a coloured HTML diff
  • Check-out/check-in locking prevents two people editing the same controlled document at once
  • Distribution lists by role or named user auto-generate read-and-understood obligations when a document goes effective
  • Documents can be organised into binders (parent/child with contains/references/supersedes relations) and printed as one combined PDF with a cover and table of contents
  • Approved documents with a future effective date stay pending effective until a scheduled job promotes them automatically

Course player & HRIS sync

  • SCORM 1.2 and 2004 course player: upload a package, launch it with a full runtime adapter, the trainee reviews the reported score and e-signs completion.
  • xAPI/cmi5 statements map completed and passed results to the right training record, still requiring an e-signed confirmation before it closes.
  • HRIS connectors for Workday, UKG Pro and ADP plus CSV import, with a dry-run diff before accounts are created or deactivated and roles updated from job titles.
Instruments · bench capture · environment

Instruments & hands-free capture

Real device drivers — Mettler-Toledo and Sartorius balances, Fluke and Keysight SCPI instruments, Mitutoyo Digimatic, Modbus sensors — drive the instrument through the procedure and record what it actually read. OPC-UA, MQTT and Modbus edge ingestion binds live sensors to assets, batch steps and SPC series, and a documenting-calibrator bridge exports task packages and imports results with reconciliation and e-signed apply. A downloadable on-prem bridge now speaks serial or TCP directly to bench instruments — thirteen fixture-tested drivers, disk-buffered through outages, running as a Windows, Linux or macOS service.

Capture

  • Device and driver registry via the instrument hub
  • Hands-free auto-run through the procedure
  • Live evaluation of each reading against tolerance and guard band
  • Readings recorded as read, not as typed

Reference standards

  • Typed ranges and per-point accuracy; accuracy formulas need a real term (±0 is refused)
  • Capability search: which standard can cover this job
  • Standards created from the product catalog
  • Intermediate checks due list

Environment

  • Environment zones, readings and limits per lab
  • Impact assessment of an excursion on the calibrations performed during it
  • Environment limits checked at perform

Custody

  • Tool-crib check-out and check-in with history
  • Trip kits per field job
  • Reference standard validity checked against its own calibration due date

Edge & sensors

  • OPC-UA subscriptions, MQTT (JSON or Sparkplug-shaped payloads) and Modbus TCP polling feed a tag registry that binds each sensor to an asset meter, an environment zone, an in-process batch step, a condition-monitoring rule or an SPC series
  • Every accepted reading is kept in a monthly-partitioned, de-duplicated raw-value audit trail, real or simulated, always labelled
  • Sensor captures on a batch step are append-only; an out-of-limit reading flags an exception that stays until a reviewer dispositions it
  • Limit and data-quality alarms de-duplicate and are acknowledged with a full audit trail; on-disk buffering with ordered replay survives a lost link to the platform
  • Hardware-free simulation exercises every binding path for OQ, always flagged as simulated and refused against a released batch

Calibrator bridge

  • Task-package export per calibration event (JSON, XML, CSV) plus a MET/CAL-compatible procedure stub and a Beamex-style CSV, with the supported subset stated in the file and at the schema endpoint
  • Results import from MET/CAL, CSV or JSON with a reconciliation report (matched, unmatched, tolerance mismatch, duplicates) before anything touches a reading; apply is e-signed by the performing technician with SHA-256 provenance on every import
  • Auto-run capture policy per measurement-form point: settling time, sample count, stability window and retry on unstable; the sampled Type A (s/√n) feeds the point's uncertainty budget as the repeatability contributor
  • Driver test harness runs raw frames through the real parser with no device attached; simulated devices replay fixtures through the same parser, always labelled sandbox
  • Per-device command overrides for firmware dialects, a full read and command I/O log, and a compatibility matrix of drivers × registered devices × last test result

On-prem bridge & drivers

  • A downloadable on-prem instrument bridge (Node) speaks serial or TCP to bench instruments and relays readings and commands to the platform, buffered to disk through any outage; runs as a service on Windows, Linux or macOS.
  • Device pairing with one-time tokens exchanged for a device-scoped credential; a compromised bench PC exposes only the one device it was paired to.
  • Thirteen fixture-tested drivers: Fluke 8845A/8846A/8588A, Keysight 34461A/34465A, Fluke 5522A/5730A calibrators, Mensor and Druck pressure controllers, Fluke 1586A, Additel, Ohaus, Sylvac/Mahr, plus the original Mettler, Sartorius, SCPI, Mitutoyo and Modbus drivers. The matrix states fixture-tested versus certified honestly.
  • Auto-run can set a calibrator to a point's nominal and wait for the bridge's acknowledgement before reading the unit under test; no sourced reading is ever fabricated.

Historians

  • PI Web API and AVEVA Historian REST connectors pull process and calibration data straight from an existing plant historian; browse an Asset Framework hierarchy or a flat tag list and bind tags exactly as with OPC-UA. Authentication is Basic or Bearer only: Kerberos/NTLM (Windows-integrated) endpoints need a gateway or Basic enabled on the server.
  • One-click Kepware project import pre-populates an OPC-UA source's tag list from the Configuration API.
  • Any tag can be marked critical with a maximum tolerable silence: a gap raises an alarm and, if the tag feeds an in-process batch step, flags the batch for release review; the fail-closed buffer policy pauses the source rather than dropping data.
  • NTLMv2 authentication for PI Web API and AVEVA Historian (pure JavaScript, MS-NLMP vectors cross-checked against an independent implementation); Kerberos/SPNEGO is declared unsupported with a documented reverse-proxy pattern; a live TLS-isolation self-test proves a self-signed-tolerant call never loosens a concurrent strict one. Not yet tested against a live PI or AVEVA server.

GPIB / IEEE-488

  • Drive IEEE-488 instruments (Fluke 5700A/5720A/5520A, Keysight 3458A/8508A and others) through a Prologix GPIB-ETHERNET controller: the bridge addresses each device before every command, so one controller carries a whole bench without cross-talk; all 13 drivers run unchanged and are tested byte-for-byte over GPIB and raw TCP.
  • Device wiring is validated at save time (unknown transport or a GPIB address outside 0–30 is refused), and the transport catalogue served to the UI comes from the bridge code itself, so the two cannot drift.

Documenting calibrators & MET/CAL

  • MET/CAL FSC-subset interpreter with an explicit supported/unsupported construct matrix (never silently drops a line), a dry-run simulator that never invents a measured value, one-click draft executable procedure from an interpreted file; Fluke 754 / Beamex MC6 job-file round-trip with reconciliation and e-signed apply of results (values must match the uploaded file byte for byte). No hardware execution is claimed.

Honest capture

  • A real device with no live bridge posting frames refuses the read with a clear error instead of returning a plausible number. Simulation is opt-in per device, never a global default, and a simulated reading is labelled at capture, blocked at approval and blocked at certificate issue.
Scheduling · intervals · planner

Scheduling & intervals

A twelve-month workload forecast, an interval review that measures how much tolerance each asset actually consumed and which way it drifts, and a recommendation to shorten, keep or extend — on deterministic, auditor-defensible arithmetic.

Forecast and intervals

  • Twelve-month workload forecast and overdue backlog
  • Per-asset interval review in the ILAC-G24 / NCSLI RP-1 reaction-method style
  • Interval change with e-signature and justification
  • AI-drafted week-by-week work plan (narrative only)

Planning and generation

  • Drag-and-drop technician × day planner
  • Due-order generation and quote chasing
  • Customer due notices
  • Service cycles with due list
  • ICS calendar feed

Capacity planning

  • Multi-week capacity planning from real due workload (calibrations, PM, field jobs, work and production orders) against technicians, benches and standards; what-if hire, overtime or outsource scenarios; skill-gap detection.

Finite-capacity planning

  • Deterministic finite-capacity scheduler assigns technicians, benches and reference standards to real due work from six sources (calibrations, PMs, work orders, production orders, field jobs, lab order lines) under hard constraints (calendars, skills and §6.2.5 authorization, bench kind, standard availability, parts, no double-booking, planner locks); every unscheduled item carries a named reason and a fix suggestion; explainable Gantt with per-assignment rationale; apply is idempotent and never overwrites a record changed since the run. Not a proven-optimal solver and says so.
  • Applying a plan checks each target against the state the solve actually saw. A work order, field job or order line changed by someone else since the run is skipped with a named reason rather than silently overwritten.
  • The improvement phase is iteration-bounded rather than wall-clock bounded, so the same inputs produce the same schedule on any machine, and ties are broken by a seeded generator rather than by whichever row was read first.
Maintenance · CMMS · condition monitoring

Maintenance (CMMS)

Work orders with failure, cause and remedy codes, preventive maintenance by interval or meter, and condition-based rules that raise work from the readings the system already captures — all on the same asset spine as calibration. Labour timesheets, PO approval with three-way match, job-plan checklists with part reservations, cycle counts and LOTO permit-to-work now run inside the same work-order record. Weibull reliability fitted from real work orders and calibration history now drives an asset health score, remaining useful life and anomaly-triggered maintenance suggestions.

Work orders and PM

  • Work orders with failure, cause and remedy codes, downtime and requires-recalibration
  • PM schedules by interval or meter, generated automatically
  • Failure-code catalog (ISO 14224 style)
  • Maintenance history per asset
  • Work orders move one step at a time; corrective orders cannot close without failure and remedy codes and labour hours
  • PM generation skips retired and out-of-service assets and reports what it skipped
  • Condition-based rules are tenant-validated and failures are logged, never swallowed

Condition monitoring

  • Asset meters and meter readings
  • Condition-based rules raising a work order once per open occurrence
  • Environment and instrument readings usable as conditions

Analysis

  • Asset reliability report by failure mode
  • EAM KPIs, availability, total cost of ownership
  • Parts consumption against the work order

Labour, purchasing & permits

  • Labour time: clock-in/out, manual entries, supervisor approval that locks entries, weekly timesheets, payroll CSV, craft-rate snapshots rolled into work-order cost
  • Purchasing controls: requisition → approval with role-based limits → PO, RFQ with multi-vendor comparison, three-way match of PO, receipt and invoice with a configurable tolerance
  • Job plans copy a task checklist onto a work order, reserve parts (on hand minus reserved) and gate completion on the checklist
  • Cycle counts with e-signature above a variance threshold posting stock adjustments on approval; ABC classification and reorder points from stock-move history; storeroom transfers; serialised spares
  • LOTO and permit-to-work (draft → issued → active → closed, e-signed) that blocks a work order from starting without an active permit and from closing while one is open; printable permit PDF
  • Downtime reasons (planned/unplanned) rolled into MTBF/MTTR by asset class and schedule-compliance KPIs

Predictive maintenance

  • Weibull reliability per asset class fitted two ways (maximum likelihood with censoring and median-rank regression) from real corrective work orders and failed or conditional calibrations; B10/B50 life, hazard curves, MTBF/MTTR trends with control limits.
  • Asset health score (0–100) from age against the fitted distribution, open exceptions, overdue PM or calibration, drift and live anomaly signals; remaining useful life from conditional survival.
  • Edge-sensor anomaly detection (rolling z-score, EWMA, Westgard rules, seasonal baseline) raises a reviewable suggestion, never an automatic work order.
  • PM-interval cost optimiser once the lab supplies its own PM and failure costs.

Warranty, FMECA & strategy

  • Warranty tracking with claims and recovery, FMECA with an RBI-style criticality band, capital projects with budget versus actual, and a strategy library that requires a stated PM, condition-based or run-to-failure justification per asset class.

Spatial & linear assets

  • GeoJSON layers rendered as inline SVG (no map library, tiles or PostGIS), linear-referenced pipe/cable/fence segments resolved to coordinates, a configurable 0–100 condition index, replacement-priority ranking with a plain-English reason per asset, and a mobile-first map-guided inspection-route runner with photo-annotated defect capture.
Enterprise asset management

Enterprise asset management (EAM)

A real hierarchy — customer → site → building → room → bench, with parent and component systems — typed specifications with provenance, custody, meters, cycles, a GxP logbook and reverse traceability.

Register

  • Hierarchy customer → site → building → room → bench with parent and component systems
  • Facets, bulk edit, CSV export, taxonomy classification and back-fill
  • Custodians, criticality, custom fields per asset
  • Facility map with seeded standard sites

Specifications

  • Typed tolerance formulas: absolute, percent of reading, percent of range, ppm, counts, floor terms, combinations
  • Specification provenance: document, revision, clause; origin; AI-assisted flag
  • Product catalog and spec library with verification tiers and per-lab overrides

Life and custody

  • History, history document, metrics, TCO, availability, quality panel, drift, suggested points
  • GxP equipment logbook (auto and manual entries, append-only), qualification, e-signed status change
  • Tool-crib custody and trip kits; recurring rounds with facility-order optimisation and guided runs
  • Reverse traceability graph and record links
Manufacturing execution · MES

Manufacturing execution (MES)

Recipes and BOMs, production orders, versioned work instructions and electronic batch records that run: steps in order, each with its own e-signature, exceptions dispositioned, and the batch moving itself to review when the last step closes. Review-by-exception batch release, seven new batch-record step types, in-process SPC with Nelson-rule detection, and scale-in-the-loop dispensing with barcode verification extend execution beyond numeric entry.

Definition

  • Recipes and BOMs with materials
  • Production orders and campaigns
  • Versioned work instructions

Execution

  • Ordered step execution with per-step e-signature
  • Line clearance, in-process deviation, material dispensing
  • Exceptions and dispositions
  • Instrument calibration status checked at the moment of use
  • Batch release only from review, with every step executed and line clearance passed; production quantities required (or an audited override with a reason)
  • Executed steps can never be re-initialised; executed values, operators and signatures are immutable
  • Dispensing is e-signed and checked against the bill of materials; off-BOM material needs an override reason and becomes a reviewable exception
  • Lots are unique per product; each batch snapshots the exact recipe and work-instruction revision it ran under
  • Concurrent edits are detected: two operators cannot overwrite each other's steps or dispenses

Traceability and analysis

  • Genealogy, material-lot where-used, lot trace
  • OEE, yield report, MES analytics, floor board
  • Equipment ↔ batch usage per asset
  • Batch record printed as a controlled record document

Dispensing & scanning

  • Scale-in-the-loop dispensing: tare, gross and net captured from a registered balance; a scale-required policy refuses typed weights
  • Dispensing policy per tenant and per recipe: typed, scale-preferred or scale-required; a capture is blocked when the balance's own calibration is overdue
  • Potency and assay-adjusted targets with the arithmetic shown on the record; partial-container tracking and expected-versus-dispensed reconciliation with variance
  • GS1-128 and plain barcode verification against the BOM and lot register, by phone camera or keyboard-wedge scanner; a reusable scan component for the rest of the app
  • Printable dispense labels with QR and an audited reprint counter

Review by exception & SPC

  • Review-by-exception batch release: reviewers see only flagged exceptions; release needs an e-signed reviewed-by-exception assertion from someone other than the releaser (segregation of duties), opt-in per tenant
  • Seven new batch-record step types beyond numeric entry: yes/no with a mandatory comment on no, multiple choice, server-computed calculations (safe formula parser), start/stop timers with over-duration flags, photo steps, second-person countersigned verification and read-and-acknowledge instructions
  • Parallel step groups, dependencies and conditional auto-skip in batch checklists
  • In-process SPC: control-chart series per recipe step or named critical attribute, Nelson rules 1/2/3/5/6 evaluated live, exceptions raised automatically; Cp, Cpk and Ppk on demand
  • Batch review queue and metrics (open exceptions, review time, exceptions by type) and a printable review-by-exception record

QC, LIMS & serialization

  • ANSI/ASQ Z1.4 sampling: lot size to code letter to sample size (general levels I–III), used by sampling plans or standalone.
  • QC sampling plans with numeric and attribute tests, samples with chain of custody, e-signed result entry that checks the instrument's calibration status.
  • Out-of-specification workflow (initial assessment → lab investigation → full-scale → disposition) opened automatically on any failing result, linked to a deviation, with retest tracking.
  • Material-lot disposition (quarantine, released, rejected, on hold) e-signed; on-hold lots cannot be dispensed; batch release requires finished-goods tests to pass or a dispositioned OOS, alongside the review-by-exception gate.
  • Certificate of Analysis PDF generated from recorded results and disposition; LIMS export (JSON, CSV, ASTM-style), e-signed reconciled import and a results-push webhook staged for human review.
  • GS1 serialization: SGTIN and SSCC commissioning with check digits, aggregation trees, UDI-DI/PI composition and EPCIS 2.0 JSON-LD event export.

ISA-88 batch orchestration

  • ISA-88 master recipes as unit procedure → operation → phase trees with equipment class and required state per unit procedure, versioned and gated behind an approved change control; control recipes run on the existing step engine.
  • Equipment states (idle, clean, dirty, in use, hold, maintenance) with clean-hold and dirty-hold expiry; a phase cannot start until its equipment is in the required state; e-signed transitions land in the GxP logbook.
  • Phase-level QA hold points with e-signed placement and release; golden-batch trajectory comparison with a computed envelope that flags excursions.
  • Procedural state model with seven states (idle, running, held, restarting, aborting, aborted, complete) enforced through one transition table; hold and abort cascade to running descendants in one transaction. Unit allocation is arbitrated by a database constraint (a second batch claiming held equipment gets a 409 naming the holder). Batch-size scaling is previewable: materials scale linearly, parameters only when a phase opts in. The equipment-module command/acknowledge loop is simulated, marked as such on every command, with timeouts surfacing in the review-by-exception workbench. No PLC or DCS claim is made.

Acceptance sampling (Z1.4)

  • The complete ANSI/ASQ Z1.4 single and double sampling tables with acceptance and rejection numbers, arrow-chase and 100%-inspection resolution, general levels I–III and special levels S-1 to S-4, transcribed and verified cell by cell.
  • Automated switching per plan, supplier or product: normal to tightened after 2 of 5 rejected lots, tightened back to normal after 5 accepted, tightened to discontinued with manual reinstatement, normal to reduced after 10 accepted lots within the Table VIII limit with approval, reduced back to normal on a rejection; full history kept.
  • One-call lot evaluation returns sample size, Ac, Re, the decision and the switching outcome for single or double sampling, with an automatic hook from attribute QC results; plan configuration is versioned and audited.
  • All seven inspection levels (general I–III, special S-1 to S-4) resolve through one Table I lookup; an unrecognised level is refused rather than treated as level II. The master tables are re-derived in CI against a second published transcription (12,747 cell comparisons; five transcription defects were found and fixed this way).

LIMS depth

  • Sample login with a numbered sequence, matrix and storage tracking, parent and child aliquots, and printed sample labels (PDF or ZPL) through the label engine.
  • Worksheets group tests for one instrument run and are refused when the instrument's calibration is overdue; analysts can be assigned only when training records show competence for the method; method parameters and limits are versioned and every result records the version it was graded against.
  • Reagent and reference-material lots with expiry: result entry is blocked on an expired lot; calculated results use the safe formula engine; second-person review and approval with segregation of duties and e-signatures; out-of-spec results open the shared OOS investigation.
  • Stability studies with condition and timepoint pull scheduling and ICH Q1E shelf-life estimation (linear regression, one-sided 95% confidence, worst case across conditions).
  • ICH Q1E §II poolability: ANCOVA F-tests on slopes then intercepts at α = 0.25 across stability batches, never mixed across storage conditions, with a from-scratch F-distribution; the fixture is hand-computed with every sum of squares shown because no published worked example with raw data was found.
  • Instrument-file parser SDK: versioned, e-signed parser definitions (draft → review → approved → retired) for CSV/TSV/fixed-width with Waters Empower and Agilent OpenLab export templates (document-derived, unvalidated against live instruments), dry-run → parse → review → bind through the existing result-entry gates, and a checksum-vaulted raw-file store with an append-only chain of custody.
  • Environmental monitoring programme: locations and sampling points with alert/action/spec limits, schedule generation from daily to per-shift with missed-window detection, one-click collection into a real LIMS sample, action- or spec-level excursions opening a numbered deviation, Nelson-rule control charts per point, a capacity calendar flagging over-booked days, and audited e-signed result invalidation that removes a result from every statistic, report, CoA, poolability test and ERP push while keeping it struck-through on the record.

Serialization exchange

  • EPCIS 2.0 JSON-LD and 1.2 XML import with dry-run preview, de-duplication and automatic status mapping; receiving reconciliation against expected serials per shipment or PO (matched, missing, unexpected).
  • Full serial lifecycle (commissioned, packed, shipped, received, decommissioned with reason) with e-signed recommission; DSCSA VRS-style saleable-returns verification by GTIN and serial with full history.
  • Trading-partner profiles with SFTP and HTTPS delivery of EPCIS documents and a delivery log; DSCSA and EU FMD submission status per batch, manual or through a configurable adapter; AS2 stays a documented hand-off.
  • Trading partners POST EPCIS 2.0 JSON-LD or EPCIS 1.2 XML to a capture endpoint with a per-partner key or client certificate; capture is idempotent by event id, dry-runnable and logged. A standard SimpleEventQuery endpoint answers eventTime/bizStep/action/EPC filters with paging, scoped to the tenant and the partner's visibility. Captured events drive the serial lifecycle and shipment reconciliation. Subscriptions, named queries and MasterData capture are not implemented and the discovery endpoint says so.
  • The AS2 simulator answers an unknown partner, an undecryptable payload, a bad signature and a wrong certificate with one identical refusal, so it cannot be used to discover which trading partners exist, and repeated message ids are rejected behind the cryptographic check rather than in front of it.

Acceptance sampling (Z1.9 variables)

  • ANSI/ASQ Z1.9 variables sampling: Table A-2 code letters and Table B-1/B-2 s-method plans (n, k, M), Form 1 (k method) and Form 2 (M method) lot disposition on real measurements, normal/tightened/reduced switching on the same audited engine as Z1.4. Plan tables are re-derived in CI against a second source; the k column is computed (beta-quantile) and excluded from that check, as stated on the test line. Range method (Table C-1) and known-σ (Table D) are refused with a reason, not approximated.

Serialization conformance workbench

  • EPCIS 2.0/1.2 conformance validator (structure, GS1 check digits, CBV vocabulary, 23 error codes), partner conformance profiles, a 30-document test corpus, aggregation/duplicate/replay scenarios against the live capture endpoint, a clearly labelled AS2 loopback simulator (CMS signing and encryption, MIC, replay idempotency, signature-failure MDN; inbound authenticated only by a signature under the peer's registered certificate) and VRS/NMVS mock endpoints. No production AS2 claim.
Field service · offline

Field service

Field jobs on a live dispatch board grouped by technician, van stock per vehicle, trip kits with the standards a job needs, and the same calibration engine in the technician's hands — with or without a signal. Dispatch v2 adds map-based route optimisation, skill-matched technician assignment, SMS appointment notifications and service-contract entitlements with SLA tracking.

Dispatch

  • Dispatch board by technician
  • Field job and van stock records
  • Trip kits per job
  • Field analytics

Offline

  • Device outbox for captures and notifications
  • Idempotency keys so a sync can never double-apply
  • Signatures applied at sync by the signing user, never offline

Dispatch & appointments

  • Dispatch board with an SVG map, an unassigned bucket and route optimisation (nearest-neighbour plus 2-opt on travel time) that respects customer appointment windows
  • Geocoding through Nominatim with address caching and manual override; optional OSRM road times
  • Skill- and authorisation-aware technician matching with a scored, explained candidate list per job
  • SMS via Twilio for appointment confirmations, day-before reminders, en-route ETAs and post-visit rating links, opt-in with STOP/START handling and signature-verified webhooks
  • On-site customer acknowledgement (signature pad and photos), kept distinct from the technician's Part 11 e-signature
  • Service-contract entitlements: covered, billable or expired decided at job creation, SLA due tracking and an at-risk queue; field analytics with first-time-fix, MTTR, travel-versus-wrench and SLA attainment

Offline field mode v2

  • Pack a service order, work order, field job or draft calibration event to the device and keep working with no signal.
  • Enter readings, tick work-order tasks, add notes and attach photos entirely offline; everything queues locally in IndexedDB until connectivity returns.
  • Reload the app while offline and it still works: the service worker serves the cached shell and captures stay safe.
  • Signatures are never captured offline; every reading is applied and e-signed live at sync, keeping 21 CFR Part 11 intact.
  • If the server record changed while offline, a Conflicts panel shows both versions: keep yours, take the server's or merge readings point by point.
  • Background Sync flushes non-signed writes the moment connectivity returns; signed captures wait for the technician. Capacitor-ready for native store builds.

Native mobile readiness

  • The offline field mode uses encrypted on-device SQLite when running as a native iOS or Android app, transparently to the rest of the app.
  • MDM-managed configuration (server URL, workspace lock, SSO enforcement, offline disable) through standard Android App Restrictions and iOS managed-config schemas, with a server-side policy fallback.
  • Remote device wipe from the device fleet: the app purges local data and signs out on its next poll.
  • Native barcode scanning (ML Kit) with automatic fallback to the browser scanner; native push (FCM/APNs) as a notification channel.
  • CI pipelines for TestFlight and Play internal-track builds. Store builds still need a Capacitor 8 toolchain (Node 22, Xcode, Android SDK) and Apple/Google accounts.

Vehicle routing

  • A real vehicle-routing solver with time windows: cheapest-insertion construction and relocate, exchange, 2-opt, 2-opt* and or-opt local search under a time budget; beats nearest-neighbour by 95% on the 40-job benchmark.
  • Hard constraints: required skill plus formal §6.2.5 authorisation, fixed break windows, van weight and volume capacity from the part catalogue, maximum jobs per technician per day; soft or hard territories.
  • Dispatcher pins lock a job to a technician and preserve order across re-optimisation; dynamic re-optimisation keeps on-site, en-route and completed jobs fixed.
  • Every run returns side-by-side KPIs against the current schedule and the quick optimiser, per-stop explanations and plain-language reasons for unassigned jobs; pluggable travel-time providers (haversine, OSRM, Google, Mapbox) that refuse cleanly when not configured.
Parts · purchasing · lab inventory

Parts & inventory

Two stock surfaces on one record: CMMS parts and purchase orders, and lab-grade inventory of reagents, reference materials, standard solutions, gases and consumables tracked by lot with expiry, certificate of analysis and storage location.

Parts and purchasing

  • Parts with stock moves, lots and consumption
  • Purchase orders with lines and receiving
  • Automatic purchase orders from low stock
  • Consumption against work orders and calibrations

Lab inventory

  • Reagents, reference materials, standard solutions, gases and consumables by lot
  • Expiry, certificate of analysis reference, storage location
  • Receive, issue (FEFO), adjust, dispose
  • Low-stock, expiring and expired alerts; inventory summary
Service pipeline · clients

Service pipeline & clients

An order opens with a phone call and grows as units arrive: quote → accept → schedule → receive → calibrate → ship → invoice → close, with the timeline, the documents and the customer conversation on one record. Commercial pricing with tiered price lists and multi-currency tax rules, carrier shipping labels with RMA returns, and Stripe-hosted payments now run from inside the same order. Live tax calculation through Avalara or TaxJar, exemption certificates and nexus lookup, and PEPPOL/Factur-X e-invoicing now run from the same order.

Orders

  • State machine quote → accept → schedule → receive → calibrate → ship → invoice → close with a timeline
  • Per-item pricing from a price book; tax and currency from the lab identity
  • QC hold, item instructions and review per item
  • Contract review (e-signed) before acceptance when required
  • Order ↔ portal message thread; order notifications and outbox with statistics

Documents

  • Quote, packing list, invoice with bill-to and terms, service report, statement, credit notes
  • Certificate package per order
  • AR aging, job costing and executive summary reports

Clients

  • Structured and billing addresses, contacts, agreements with renewal and expiring list
  • Duplicate finder and merge; overview and summary
  • Portal users managed per client
  • Customer due notices and statements

Pricing & billing

  • Customer-specific and tiered price lists with volume breaks and contract discounts; the resolver explains which rule won
  • Multi-currency orders and invoices with FX snapshots and daily ECB rate sync
  • Tax rules by jurisdiction with EU B2B reverse-charge detection and VIES VAT-number validation
  • One-click consolidated monthly invoicing across a client's completed orders
  • Automated credit hold and dunning at 7, 14 and 30 days overdue, with a client billing profile
  • Blanket purchase-order tracking with warnings at 90% consumed; deposits recorded as credit

Shipping & RMA

  • Buy return-shipping labels from inside the order via EasyPost or Shippo: live rates, one-click purchase, cached PDF labels, refunds on unused labels
  • Every outbound shipment is gated on certificates: an order cannot ship uncertified items without an audited override reason
  • Customer portal: request a return authorisation, receive a prepaid label or return instructions, and follow it back to the lab
  • Custody scanning on receipt catches a wrong-asset mistake before it becomes a lost instrument
  • Carrier webhooks keep tracking status live on the order timeline; no manual polling
  • Cross-border shipments require a full customs declaration (contents type, incoterm, per-line HS code, origin, value and weight, AES ITN or exemption) validated before a label can be bought; per-asset and per-part customs defaults auto-fill items.
  • Commercial invoice PDF previewable before buying and downloadable after; CN22/CN23-style summary on international packing lists; EasyPost and Shippo customs objects attached before purchase; duties shown only when the carrier returns them.

Payments

  • Stripe-hosted Checkout for invoices and deposits: card and bank details never touch Metroliq
  • Deposits on quote acceptance computed from a configurable percentage and booked as an open credit against the customer balance
  • Pay-by-link with a QR code for technicians on site
  • Webhook-driven receipts as PDF, test-mode badges when Stripe test keys are used, provider balance-transaction reconciliation with manual matching
  • E-signed refunds that automatically issue a credit note

Tax & e-invoicing

  • Tax calculated live through Avalara AvaTax or TaxJar when connected, with automatic fallback to the built-in jurisdiction rules; per-line tax codes for service, parts and shipping; every calculation and commit logged per invoice for audit.
  • Exemption certificates apply automatically once verified, with expiring-certificate reminders; address validation and nexus lookup in the settings screen.
  • PEPPOL BIS Billing 3.0 (UBL 2.1) e-invoices and Factur-X/ZUGFeRD-style PDFs with the CII XML embedded, downloadable for consolidated invoices and credit notes; access-point delivery is documented as a hand-off.

PEPPOL delivery

  • Send consolidated invoices and credit notes to a PEPPOL access point: Storecove wired as the reference provider, or any REST-based access point configured without code (endpoint, auth header, payload template).
  • Participant ID validation for GLN, Norwegian, Belgian, Swedish, Danish and German schemes with real check-digit verification; live recipient lookup against the PEPPOL SML/SMP network before sending.
  • Delivery timeline per document (queued, sent, delivered, rejected) with polling and webhooks; an inbound inbox parses supplier e-invoices and suggests a purchase order for three-way match; clearance regimes (Italy, France, Poland) flagged as unsupported rather than silently accepted.
Customer portal

Customer portal

Each customer gets a branded portal scoped hard to their own customer id: instruments with status and due dates, certificate history, quote approval, service requests (including bulk), statements and invoices, and public certificate verification by number.

Portal

  • Dashboard: what is due, what is in the lab, what is ready
  • Assets with status, due dates and history; self-registered assets with lab-side review and accept
  • Certificates with current revision and result; download always the revision in force
  • Service requests, single or bulk; withdraw; quote approval on the order timeline
  • Due list, statement and invoices
  • Feedback and complaints that land in the QMS
  • Confidence page explaining how results were decided
  • Shared order ↔ portal message thread
  • Portal users managed per client by the lab

Verification

  • Public verify page by certificate number: valid, superseded, revoked, under review
  • Recommended recalibration date and in-date flag
  • Record hash shown

Isolation

  • Portal accounts can reach only portal routes
  • Every portal query filters by tenant and customer id
  • Portal users never see the lab shell
AI-native · builders · provenance

AI builders & provenance

Drop a manufacturer datasheet and get a typed specification and a five-facet measurement form. Drop an old certificate PDF and get a template. Drop your old system's export and get an approved column mapping. Every AI output is a draft for a qualified person, and the provenance ledger records the model, the prompt hash, the output, the citations and who approved it.

Builders

  • Spec extraction from a manual or datasheet with review queue, verification tiers, candidate approve/dismiss and per-lab overrides
  • Cal Builder: five-facet measurement forms (points, tools, rounding, acceptance, environment)
  • Measurement forms drafted straight from the product library by manufacturer and model: the catalogue's typed accuracy and checkpoints, no datasheet and no AI guesswork; datasheet PDF or pasted spec for uncatalogued instruments
  • Uncertainty study builder from published guides
  • Bench procedure step drafting
  • OOT investigation and CAPA drafting grounded in reverse traceability; generic QMS record drafting
  • Integration field mapping; import and migration column mapping; certificate-layout ingestion; AI work plans; custom make/model sanity check
  • Management review drafted from analytics as a controlled document

Provenance

  • Ledger per draft: feature, model, model version, prompt and its SHA-256, output, citations, approver, edited flag
  • Certificate-level provenance: spec source, origin, document, revision, clause, AI-assisted flag with printed statement
  • Built-in assistant answers are written to the same ledger
Integrations · API · automation

Integrations, API & automation

A visual integration builder with a ten-system catalog plus generic REST and CSV, AI-proposed field mapping with a dry run, signed webhooks with delivery logs and bounded retry, API keys on a versioned API, notification channels with a rules engine, and a configurable workflow engine with e-sign gates. An OpenAPI 3.1 spec generated live from the router feeds Redoc documentation, a Postman collection and SDK stubs, and QuickBooks Online / Xero connections push invoices, credit notes and payments automatically. NetSuite, SAP S/4HANA Cloud and Dynamics 365 Business Central now join QuickBooks and Xero as accounting connectors, and a read-only OData v4 feed with a Power BI guide and CSV.gz exports opens the platform to BI tools.

Integrations and API

  • Visual integration builder: ten-system catalog plus generic REST and CSV, field mapping with transforms, AI-proposed mapping, dry-run preview
  • Records in three ways: CSV or JSON file upload, a pasted sample, or an API push to the integration's run endpoint; existing rows matched and updated, new ones created
  • Export through the same mapping: Metroliq field to external column as CSV; every import and export recorded in a per-integration run history
  • Connection credentials stored per integration and masked when shown; re-saving a mapping never wipes a token
  • Outbound webhooks with signed payload, idempotency key, delivery log and bounded retry
  • API keys; versioned API surface with supported versions listed
  • Units engine with named conversion rules and measurement techniques

Import and migration

  • Universal import (Excel/CSV/TSV) with analyse, remap, preview, run — assets, history, clients, standards, inventory, parts
  • Legacy competitor migration including history; original certificate numbers preserved; idempotent and audited
  • Phantom records rejected

Notifications, workflow, automation

  • Channels: Teams, Slack, SMTP, Microsoft 365, Gmail, generic webhook — with event filters and a test
  • SMS channel (Twilio) alongside Teams, Slack, SMTP, Microsoft 365, Gmail, webhooks and Web Push: opt-in per contact with STOP/START handling, signature-verified inbound webhooks, and a clear not-connected state until credentials are set
  • Rules engine with path templates, digests and escalations
  • Configurable workflow engine: states, transitions, role guards, e-sign gates, actions, SLA and aging, immutable history
  • Automation sweeper every 30 minutes: digests, due orders, PM, scheduled reports, customer notices
  • Data reports builder with CSV run, schedule, pin, publish as document; job costing, data integrity, team productivity, executive summary, AR aging

API documentation

  • OpenAPI 3.1 description of every core endpoint, generated from the running router so it never drifts from the code; security scheme per route (session, API key, platform admin, portal)
  • Redoc documentation page served by the platform, plus a Postman collection and JavaScript/Python client stubs generated from the same spec
  • API change log: each boot snapshots the operation set and records added/removed operations, giving a deprecation record
  • Every endpoint documents its auth model and e-signature requirement

Accounting sync

  • QuickBooks Online and Xero connections per tenant over OAuth2, with refresh-token rotation and tokens encrypted at rest
  • Master-data mapping for customers, price-book categories to items, tax codes and accounts, with live pickers from the accounting system
  • One-click push of invoices, credit notes and payments, idempotent by document number: a re-push updates instead of duplicating
  • Remote payments pulled and applied through the existing overpay-guarded payment ledger
  • A five-minute background sync queue plus an error workbench with retry and ignore-with-reason

ERP & historian connectors

  • NetSuite, SAP S/4HANA Cloud and Dynamics 365 Business Central join QuickBooks Online and Xero as accounting connectors on the same mapping, queue and error workbench; NetSuite requests signed with token-based OAuth 1.0a.
  • ISA-95 B2MML import turns ProductionSchedule, MaterialDefinition and EquipmentDefinition XML into production orders, parts and equipment; a batch record exports as a ProductionPerformance document.
  • OPC-UA sources support Sign and SignAndEncrypt with client-certificate generation and a trusted-server store; a live node-tree browser fills the tag mapper; MQTT over TLS with client certificates.
  • The edge connector's disk buffer is bounded with an oldest-drop policy and an overflow alarm; Prometheus metrics; Postgres-backed leader lease for two-instance high availability; mutual TLS to the platform when served over HTTPS.

BI & data export

  • Read-only OData v4 feed: nine entity sets with $filter, $select, $top, $skip, $orderby and row-level scope.
  • Power BI guide with a .pbids file for direct connection.
  • CSV.gz exports by signed download or SFTP push, on manual or scheduled runs.

ERP objects

  • SAP S/4HANA Cloud: purchase-order push, goods-receipt push and pull, maintenance order and service-confirmation push, plant, cost-centre and product master pull, with CSRF-protected writes.
  • NetSuite: purchase orders, item receipts (push and pull) and manufacturing work orders; Dynamics 365 Business Central: purchase orders with lines; receipts refused with a clear message where the public API has no writable entity.
  • Every push is idempotent by document number; a dedicated ERP error workbench with retry and ignore; vendor, part, plant and cost-centre mapping shared across providers.
  • SAP QM and PP objects: pull inspection lots and characteristics, link them to samples, lots or batch records, push characteristic results (blocked until the local result is approved, and never an out-of-limit value as accepted), record an e-signed terminal usage decision, raise quality notifications from an NCR, complaint or OOS, and push process-order confirmations. A built-in sandbox-only S/4HANA OData simulator (Basic auth, CSRF handshake) exercises the real transport code and labels every record test mode; no live SAP has accepted a document from this code.

Warehouse & CDC

  • Change-data-capture feed with cursor pagination over inserts, updates and deletes on assets, calibrations, certificates, service requests, quality records and readings, scoped by tenant and row-level security.
  • Push exports to AWS S3, MinIO or Cloudflare R2 (SigV4), Azure Blob (SAS), Snowflake (COPY INTO script and Snowpipe with key-pair JWT), Databricks Auto Loader and Microsoft Fabric OneLake; scheduled jobs can target a saved destination.
  • Semver-versioned export schema with a data dictionary; connection tests make real authenticated calls and report failures honestly.
  • Bootstrap handshake: one call returns a consistent full extract and the change-feed cursor from a locked read, so no change falls between snapshot and stream. Retention is configurable per tenant (default 30 days) with a scheduled sweeper; an expired cursor gets 410 Gone with a re-bootstrap instruction. CDC covers assets, calibration events, certificates, service requests, ops records, readings, customers and sites, with a sub-type tag for work orders and certificate revisions.
  • The Parquet export now writes genuine Apache Parquet (typed columns, row groups, Thrift footer; verified by reading back with pyarrow), uncompressed and without dictionary pages; CSV.gz remains available separately.
Compliance · validation · security

Compliance, validation & security

ISO/IEC 17025:2017 and 21 CFR Part 11 are not features bolted on; they are how the record works: a SHA-256 hash-chained audit trail, two-component electronic signatures bound to meaning, independent approval, supplier validation evidence — our FS, IQ, self-running OQ and test reports — plus your own PQ, retention policies and legal holds, SSO, SCIM and 2FA. Security headers, a tuned content-security policy, per-IP-and-tenant rate limiting and tightened request-size limits harden the API and web app, with a live headers-check endpoint for review.

ISO/IEC 17025:2017

  • §6.2.5 technician authorization per discipline enforced at perform
  • §7.8.2 certificate content: lab address, customer, item, procedure, standards, environment, results with uncertainty, decision rule, signatures, revision, issue date
  • §7.8.4 / ILAC-P14 uncertainty reporting: U to two significant figures, coverage factor and probability stated
  • §7.8.6 decision rules and conformity statements with the rule and its risk on the certificate
  • §7.8.8 amendments as new revisions with reasons; revocations
  • Accredited scope and CMC lines authoritative at perform; audit-readiness self-check; assessment pack

21 CFR Part 11 and data integrity

  • Electronic signatures: password as signature, two-component, bound to meaning, optional signing session
  • Audit trail: SHA-256 hash chain, canonical serialization, public verify, facets, CSV export, periodic review with overdue flag
  • Record hashes printed on certificates
  • Signed-state edits rescind signatures and are audited
  • Retention policies, legal holds, audited full-tenant export; nothing auto-deletes
  • Idempotency keys on writes so replays cannot double-apply

Validation (GAMP 5)

  • Supplier verification suite that executes against your own installed instance and signs what it found — negative tests for every gate (e-signature, segregation of duties, permits, supplier approval, review-by-exception, simulated readings, scope, rate limits); the runner asks for your signing password so e-signed steps are exercised for real, and a case that cannot run is declared not applicable rather than counted as a pass
  • Supplier functional specification, traced to the test that exercises each item
  • Installation qualification record of the deployed system, configuration and environment
  • Your validation file, authored and signed by you: scope and intended use, your own supplier assessment, your user requirements, process risk assessment, verification strategy and validation summary report
  • Five verification methods — leverage, review, unscripted, scripted, and not verified with a recorded rationale — with coverage reported against risk rather than as a pass rate
  • Performance qualification on your own procedures, templates and instruments
  • Re-runnable after every change, so revalidation is a run rather than a project
  • Onboarding content packs are idempotent and audited

Identity and access

  • OIDC and SAML single sign-on
  • SCIM 2.0 provisioning
  • Two-factor authentication, password expiry, idle logoff
  • Custom roles with granular permissions; access review
  • API keys with scopes

Metrology standards applied

  • GUM (JCGM 100) budgets with Welch–Satterthwaite; JCGM 101 Monte Carlo; JCGM 106 conformity risk
  • ILAC-G8:2019 guard bands; ANSI/NCSL Z540.3 PFA target
  • ILAC-G24 / NCSLI RP-1 interval review
  • AIAG MSA Gage R&R
  • DCC XML with D-SI units
  • ISO 14224-style failure vocabulary

Hardening

  • Security headers on the API and a content-security policy on the web app, tuned so certificate and report iframes, PDF downloads and the customer portal keep working
  • Rate limiting on login, password reset and sign-up endpoints per IP and per tenant, with a 429 and retry hint; hits land in the audit trail
  • Request-size limits tightened platform-wide with a scoped allowlist for routes that carry large files (imports, datasheets, attachments)
  • A headers-check endpoint shows the live hardening posture for compliance reviews

AI governance

  • Per-tenant AI governance: feature and model allowlists, blocked data classes, human-approval flags, private-endpoint override.
  • Redaction of emails, phone numbers and customer/user names before any prompt leaves the tenant; blocked and redacted events audited.
  • Evidence registry lists every AI feature, its model and a live prompt-template hash.
  • Eval suite that never counts mock output as a pass.
  • AI model-risk controls: a provider retention/no-training register that stays "self-declared" until someone e-signs that the contract was read; model approval (propose → review → approve/reject/retire) with segregation of duties and e-signatures; prompt-injection (10) and data-exfiltration (6) eval suites alongside the baseline, where a mock gateway scores "skipped" and never "pass"; a high-risk model cannot be approved without a passing live injection suite; the guard refuses any call naming an unapproved model once a workspace has registered one; scorecards and drift per model, surfaced in the trust controls.

Privacy & GDPR

  • GDPR erasure as a two-step e-signed workflow (report, then execute) covering users, customers and contacts.
  • Pseudonymises signature rows while leaving the audit trail intact, on a documented legal basis.
  • Subject-access export by email or username.

Accessibility

  • Skip-to-content, keyboard-operable sidebar, hubs, portal nav and top-bar controls.
  • Labelled icon buttons and inputs across the app.
  • Axe-core violations on the thirty most used screens went from 86 to 0.
  • An accessibility statement and VPAT-style table state the open items.

Security evidence

  • Automated OWASP ZAP baseline and API scans plus npm audit across all services, repeatable by script, with results in the trust evidence API and the vendor assessment PDF.
  • SOC 2 Trust Services Criteria and ISO 27001 Annex A controls matrix mapping each control to concrete evidence in the product, stating plainly where a policy or certification is still required.
  • PDF-source controlled documents render byte-faithful to the signed original, watermarked, with the signature manifest appended as an extra page.
  • Still not certified: the matrix and scan evidence are inspectable controls, not a SOC 2 or ISO 27001 certificate.
  • Negative-test matrix: every live API operation (1,658) is probed for unauthenticated, wrong-tenant, portal-user, viewer, missing-e-signature, wrong-lifecycle-state and segregation-of-duties refusal (5,138 probes per run) with a reasoned allow-list of public routes and a CI gate; the first run found 222 findings, all fixed the same day (tenant-scoped parent checks on 119 routes, a signing route open to any role, an unsigned certificate path, a lifecycle rule). Current result: 0 findings at 71% coverage, with the uncovered operations named per run.
  • Negative-test matrix now covers 1,789 operations (5,844 probes) at 87% coverage with 0 findings; a per-release performance benchmark (seeded load generator, single-node numbers stated as such) is published on the trust page with a PDF report; record numbering and certificate issuance are race-safe under concurrent requests.
  • Second adversarial code review of the day fixed a privilege escalation (tenant admins could grant themselves superadmin through user updates), a silently accepted wrong e-sign password on PRT coefficient fits, a form-designer gate enforcing one of four rule kinds, double-signed concurrent package promotions, and four places where invalidated LIMS results still leaked into reports and statistics.
  • In-flight writes during a deployment receive a service-unavailable response with a retry hint rather than a misleading validation error.

Release impact & observability

  • Every platform release gets a computed impact report (routes added or changed, affected OQ cases, suggested validation impact) and a downloadable release-impact pack PDF; OQ runs can be scoped to the cases a release affects.
  • Tenant audit trails, including every security event, can stream to a syslog collector (RFC 5424 over TCP/TLS) or to Splunk, Datadog or a generic HTTPS collector, batched and retried with a delivery log.
  • One dashboard shows live health, last success or failure and queue depth for every external connector; mTLS, OPC-UA, SAML and signing certificates are tracked with 30-day and 7-day expiry alerts.
  • The automated security baseline now also produces an SBOM, a dependency-vulnerability scan, static analysis and a secrets scan, folded into the trust evidence.

Accessibility (WCAG 2.2 AA programme)

  • Automated axe-core sweep of every application screen, the first record modal on each list page, the customer portal and the supplier portal (113 scans) runs as a CI gate together with a token-level contrast check; current result: 0 serious/critical automated findings. Automated checks catch only part of WCAG; a manual assistive-technology audit has not been done yet and is listed in the VPAT as a standing gap.
  • Certificates and reports are tagged PDFs (PDF 1.7, document language, title metadata, heading and table structure) for screen readers.
  • VPAT 2.5 (WCAG 2.2 A/AA) published with known standing gaps stated plainly; reduced-motion preference respected across the app and portals.

Validation evidence (IQ/OQ/PQ)

  • Our OQ, runnable in your instance, now carries 226 FS items and 284 executable cases across 36 modules — Z1.4 sampling, historians, PEPPOL, LIMS, serialization, ERP, warehouse egress, ISA-88, DCC signing, observability, content packs, capacity, EAM 2 and customs included; every compliance gate has a negative-path proof.
  • Latest deep run on a fresh tenant: PASS 284/284; not-applicable cases are reported separately and never counted as passes.

Validation package (GAMP 5 / CSV)

  • A Validation Package workspace (Quality → Validation Package) holds the full vendor and customer document set: Validation Plan, System Design Specification, FS (supplier), Functional Specification, Configuration Specification, Functional Risk Assessment, IQ/OQ/PQ protocols and reports, Requirements Traceability Matrix, Test Summary, Deviation Summary, Validation Summary Report and per-release Release Risk Assessments.
  • Every document is a numbered, versioned record with a draft → review → approved → effective lifecycle; reviewer and approver must differ from the author (enforced server-side) and every step is a 21 CFR Part 11 electronic signature. Going effective supersedes the previous version automatically.
  • Documents are generated from live system state, never typed twice: 234 user requirements, 464 functional-specification items cross-referenced to the OpenAPI route families, and an RTM that ties each requirement to its risk class, test case and latest executed result with coverage by module.
  • Functional risk assessment: 124 platform functions scored severity × probability × detectability with GxP impact, ALCOA+ mapping, required test rigor and controls; editable per tenant; every entry cites verified FS and OQ ids and reports gaps honestly. Part 11 (17 clauses), Annex 11 (17), data-integrity (15) and vendor-questionnaire checklists are generated with real evidence routes and e-signed.
  • Executable Installation Qualification (service versions, schema, configuration checksum, TLS/CSP headers, backup and SBOM evidence, clock sync), expanded PQ on the tenant's own configuration, protocol pre-approval by e-signature (execution refuses an unapproved protocol version when the policy is on), automatic deviation records for failed cases with e-signed closure, targeted retest, release-scoped re-execution and run-to-run diff.
  • Every document renders to a PDF with a signature manifest and stored SHA-256; one click exports the whole package as a ZIP with a manifest and hash list plus the live IQ/OQ/RTM/PQ report. Periodic review runs on a configurable interval with a signed conclusion.
  • Ten vendor SOPs (CSV methodology, risk management, change control and release back-out, backup/restore and DR, incident and security, periodic review, customer data export and decommissioning, audit-trail review, training and competence, supplier assessment) ship as effective vendor-level documents, checked against the running system and adoptable into a tenant.
  • The validation package validates itself: 12 OQ cases prove segregation of duties, signature refusal, PDF hash verification, ZIP manifest integrity, generator consistency, deterministic risk scoring and the protocol pre-approval gate. The OQ kit now carries 234 FS items / 296 cases; not-applicable is an explicit flag enforced by a CI lint, never inferred from wording.
  • Risk defaults re-curated with written GAMP 5 / ICH Q9 reasoning per function (45 high, 52 medium, 27 low of 124); an e-signed reset restores vendor defaults without touching rows the tenant assessed. The OQ suite provisions its own test sessions in-process, so it runs back to back without tripping brute-force protection. Now 260 FS items / 327 cases.
  • An adversarial code review of the package found and fixed a segregation-of-duties bypass (a client-settable author field), a hash-verify endpoint that could not fail, an evidence-filing regex that demoted a real pass to not-applicable, and a Parquet integer overflow; reviewer and approver must now differ from each other as well as from the author, and protocol approval hashes case content rather than ids. The OQ kit stands at 315 FS items / 400 cases (deep run PASS 395 executed / 5 NA), and its own report states plainly that it is a vendor-run development gate, not independent qualification evidence.

Data residency & customer-managed keys

  • Pin a workspace to a region: requests for a mismatched region are refused with 409 at the request layer; every outbound destination (warehouse, shipping, tax, payments, e-invoicing, accounting, mail, backup) is resolved to a region and refused if outside the allowed set, both when saved and when the call is made. A host whose region cannot be determined is refused until an administrator declares it (audited).
  • A data-location ledger built from the deployment's real configuration plus a subprocessor register, exportable as JSON and PDF; RTO/RPO are shown as targets until a restore drill is recorded.
  • Customer-managed keys: per-tenant AES-256-GCM envelope encryption of integration credentials and identified personal-data columns under a data key wrapped by a customer-supplied key; append-only rotation, on-demand re-key, seal (all reads refused until an e-signed emergency re-enable) and a per-operation key-use audit. Cloud KMS adapters are declared against the interface but not implemented; an honest data-class map lists every column that is not encrypted and why.

Low-code form & workflow designer

  • Configurable forms with sections, eight field types, calculated fields, conditional visibility, decision tables, required-evidence rules and transition validations, bound to CAPA, NCR, deviation, complaint, audit, risk and method status changes; the server gate now enforces all four rule kinds (required fields, visibility, evidence, transition validations) on the real transition, not only the advisory validate endpoint.
  • Versioned form definitions per environment (published versions immutable); config packages sealed with a content hash and promoted sandbox → production under an e-signature inside one transaction, with a risk-scored impact delta and proposed OQ cases per promotion.
  • Form rules are enforced on the server at record creation and on field edits, not only on status transitions, so a required field or a required piece of evidence cannot be bypassed by creating the record and editing it afterwards.
  • Closing-effectiveness reopening of a CAPA now runs through the same gated path as any other transition, so the flow matrix, the configured rules and signature rescission all apply to it.

Supplier audit

  • An audit room your auditor signs into with credentials we issue, time-boxed and read-only, with its own access log they can see
  • Our own gap register published to them first: what we have, what is partial, and what we have nothing for
  • Navigation by their checklist, clause by clause, where no answer can claim more than the gap register allows
  • Hashes, case-set comparisons and audit-chain rows they check themselves rather than accept
  • A signed per-release record of the gates that ran, tied to the build under test
  • A question channel in the room, answered and retained for the next auditor
Workspace · command center · admin

Workspace, command center & administration

The command center opens on what needs attention, with a button for each item. Around it: a personal task list, global search and a command palette, a narrated guided tour, notifications, saved views, and the administration a regulated workspace needs. An isolated sandbox clones the whole workspace for testing, and OAuth2 client-credentials machine tokens join API keys for system-to-system access.

Command center and personal work

  • Needs-attention list with one-click actions (approvals stuck, certificates not issued, aging CAPA/NCR/complaints, open work orders, data readiness)
  • KPIs: assets, overdue, due within 30 days, calibrations, checked out, certificates, pass rate
  • Quality cockpit and module tiles with open counts
  • Due-for-service by client; recent activity feed
  • My tasks: assignments and pending signatures
  • Login lands on the last page you used in that workspace

Finding things

  • Global search across tags, certificate numbers, clients and orders (press /)
  • Command palette (Ctrl/Cmd-K) and quick-create from anywhere
  • Recently viewed records; saved filter views per list
  • Row preview drawers; hub › view breadcrumbs; workspace switcher for people in several tenants
  • Narrated, interactive guided tour
  • Product library search answers in tens of milliseconds across 800,000 models (one indexed search column)

Administration

  • Users and invites, custom roles with granular permissions, access review
  • OIDC and SAML single sign-on, SCIM 2.0 provisioning, API keys
  • Two-factor policy, password expiry, idle logoff, e-signature session length
  • Config studio: branding and logo, lab identity and accreditation, date format and time zone, numbering prefixes, TUR target, decision-rule default, tax and currency, carriers, environment limits, custom fields
  • Content packs catalog with install counts; getting-started checklist
  • Platform operator console (for the Metroliq team): tenants, plans, usage, demo analytics and intake

Records, audit, validation

  • Audit trail: hash chain, verify, facets, CSV export, periodic review
  • Records lifecycle: retention per class, legal holds, audited full-tenant export
  • Validation evidence: RTM, IQ, self-running OQ, PQ, report
  • Data reports builder: CSV run, schedule, pin, publish as document; job costing, data integrity, team productivity, executive summary, AR aging
  • Lab operations and technician analytics

Sandbox, scopes & machine tokens

  • Spin up an isolated sandbox copy of the workspace (users, roles, workflows, documents, forms, assets, clients) for testing before anything touches production; refresh from production on demand, e-signed, or delete; sandboxes are excluded from billing, stats and alerts
  • Site- and customer-scoped roles restrict a user to one site or client across the asset register, calibration events, service orders and work orders
  • OAuth2 client-credentials machine tokens (RS256 JWT, one-hour expiry, scoped, verifiable via JWKS) alongside API keys
  • Web Push notifications as a channel: subscribe a device and route certificate, out-of-tolerance and service-order alerts to it
  • A sandbox clone translates every cross-table reference (declared foreign keys, conventional *_id columns and JSON references) into the sandbox's own ids; a probe fails on any reference that still points at the source tenant, and unresolved references are reported in the clone result.

Languages

  • Calibration certificates print in the customer's language with the English original alongside by default; DCC files carry the matching language attribute.
  • Per-workspace wording overrides without waiting for a release; machine-translated content is labelled and tracked with live coverage statistics.
  • Eight languages (English, Spanish, French, German, Portuguese, Italian, Dutch, Japanese) at full coverage across the core and extension screens; locale-aware dates and numbers.
  • Translation review: machine strings queue for a reviewer, certificate-statement wording needs an e-signature, and a locale is marked certified only when every key is approved.
Beta · free while we build it with the first labs and plants

Bring one lab and your real history.

The tour runs the working platform, not a mockup. Pilot on your own instruments with your own imported history — we set it up with you, and fixes ship in hours and days, not release cycles.