metroliq
Sign in Sign up free
CalibrationCertificates & DCCQuality (QMS)Documents & trainingInstruments & captureSchedulingMaintenance (CMMS)Assets (EAM)Manufacturing (MES)Field serviceParts & inventoryService pipelineCustomer portalAI buildersIntegrations & APIComplianceWorkspace & admin
Compliance · validation · security

Ready for the assessor, the auditor and the inspector.

ISO/IEC 17025:2017 and 21 CFR Part 11 are not features bolted on; they are how the record works: a SHA-256 hash-chained audit trail, two-component electronic signatures bound to meaning, independent approval, supplier validation evidence — our FS, IQ, self-running OQ and test reports — plus your own PQ, retention policies and legal holds, SSO, SCIM and 2FA. Security headers, a tuned content-security policy, per-IP-and-tenant rate limiting and tightened request-size limits harden the API and web app, with a live headers-check endpoint for review.

What the platform is built to satisfy: ISO/IEC 17025:2017 (§6.2.5 authorization, §7.8 reporting incl. §7.8.8 amendments), 21 CFR Part 11 electronic records and signatures, ILAC-P14 uncertainty reporting, ILAC-G8 decision rules, ILAC-G24 intervals, JCGM 100 / 101 / 106, ANSI/NCSL Z540.3, AIAG MSA, ISO 14224 failure vocabulary, DCC for digital certificates, and the GAMP-style validation approach used by regulated manufacturers (ISO 13485, ISO 9001 quality systems). Per-tenant AI governance with redaction and an evidence registry, a two-step e-signed GDPR erasure workflow, an accessibility pass to zero axe violations on the busiest screens, and automated ZAP/npm-audit scan evidence mapped to a SOC 2 / ISO 27001 controls matrix now back the same compliance record. Every release now carries a computed impact report and validated-upgrade pack, audit trails can stream to a SIEM or syslog collector, and the security baseline adds an SBOM, dependency-vulnerability, static-analysis and secrets scan alongside certificate-expiry alerts.

See it in the tour Every capability
Audit trailSHA-256 hash chain
E-signaturestwo-component, bound to meaning
Validation evidenceRTM · IQ · OQ · PQ
IdentityOIDC · SAML · SCIM · 2FA
In the product

What it looks like

Screens from the live platform, demo tenant. Click any screen to open it full size.

Hash-chained audit trail with verification
The audit trail: every action chained by hash, publicly verifiable, with facets, export and periodic review.
How it works

How the record stays defensible

  1. 01
    Every action is chained

    Canonical serialization, SHA-256, each entry hashing the previous. Edit history and the chain breaks visibly.

  2. 02
    Signatures mean something

    Password as signature, two components, bound to the meaning of the act (performed, approved, reviewed). An optional signing session of up to 30 minutes, or a password every time.

  3. 03
    Roles separate duties

    Custom roles with granular permissions; independent approval; discipline authorization; access review.

  4. 04
    Corrections are visible

    Certificates are amended or revoked, never edited. Signed records that are edited have their signatures rescinded, and the rescission is audited.

  5. 05
    Validate it

    Requirements traceability, IQ, a self-running OQ that produces and signs its own evidence, PQ, and a UI walk. Re-run after every change.

  6. 06
    Keep it

    Retention policy per record class, legal holds, audited export. Nothing auto-deletes.

What it includes · 87 capabilities

Everything in the module

ISO/IEC 17025:2017

  • §6.2.5 technician authorization per discipline enforced at perform
  • §7.8.2 certificate content: lab address, customer, item, procedure, standards, environment, results with uncertainty, decision rule, signatures, revision, issue date
  • §7.8.4 / ILAC-P14 uncertainty reporting: U to two significant figures, coverage factor and probability stated
  • §7.8.6 decision rules and conformity statements with the rule and its risk on the certificate
  • §7.8.8 amendments as new revisions with reasons; revocations
  • Accredited scope and CMC lines authoritative at perform; audit-readiness self-check; assessment pack
Validation kit with requirements traceability, IQ, OQ and PQ
Supplier validation evidence: our functional specification, our test specification, and our self-running test suite executed in your instance — plus the workspace where you build your own validation file.

21 CFR Part 11 and data integrity

  • Electronic signatures: password as signature, two-component, bound to meaning, optional signing session
  • Audit trail: SHA-256 hash chain, canonical serialization, public verify, facets, CSV export, periodic review with overdue flag
  • Record hashes printed on certificates
  • Signed-state edits rescind signatures and are audited
  • Retention policies, legal holds, audited full-tenant export; nothing auto-deletes
  • Idempotency keys on writes so replays cannot double-apply
Security settings with SSO, SCIM, 2FA and access review
Security: SSO (OIDC, SAML), SCIM provisioning, two-factor, password expiry, idle logoff, access review.

Validation (GAMP 5)

  • Supplier verification suite that executes against your own installed instance and signs what it found — negative tests for every gate (e-signature, segregation of duties, permits, supplier approval, review-by-exception, simulated readings, scope, rate limits); the runner asks for your signing password so e-signed steps are exercised for real, and a case that cannot run is declared not applicable rather than counted as a pass
  • Supplier functional specification, traced to the test that exercises each item
  • Installation qualification record of the deployed system, configuration and environment
  • Your validation file, authored and signed by you: scope and intended use, your own supplier assessment, your user requirements, process risk assessment, verification strategy and validation summary report
  • Five verification methods — leverage, review, unscripted, scripted, and not verified with a recorded rationale — with coverage reported against risk rather than as a pass rate
  • Performance qualification on your own procedures, templates and instruments
  • Re-runnable after every change, so revalidation is a run rather than a project
  • Onboarding content packs are idempotent and audited
Records lifecycle with retention and legal holds
Records lifecycle: retention per class, legal holds, audited full-tenant export.

Identity and access

  • OIDC and SAML single sign-on
  • SCIM 2.0 provisioning
  • Two-factor authentication, password expiry, idle logoff
  • Custom roles with granular permissions; access review
  • API keys with scopes
Hash-chained audit trail with verification
The audit trail: every action chained by hash, publicly verifiable, with facets, export and periodic review.

Metrology standards applied

  • GUM (JCGM 100) budgets with Welch–Satterthwaite; JCGM 101 Monte Carlo; JCGM 106 conformity risk
  • ILAC-G8:2019 guard bands; ANSI/NCSL Z540.3 PFA target
  • ILAC-G24 / NCSLI RP-1 interval review
  • AIAG MSA Gage R&R
  • DCC XML with D-SI units
  • ISO 14224-style failure vocabulary
Validation kit with requirements traceability, IQ, OQ and PQ
Supplier validation evidence: our functional specification, our test specification, and our self-running test suite executed in your instance — plus the workspace where you build your own validation file.

Hardening

  • Security headers on the API and a content-security policy on the web app, tuned so certificate and report iframes, PDF downloads and the customer portal keep working
  • Rate limiting on login, password reset and sign-up endpoints per IP and per tenant, with a 429 and retry hint; hits land in the audit trail
  • Request-size limits tightened platform-wide with a scoped allowlist for routes that carry large files (imports, datasheets, attachments)
  • A headers-check endpoint shows the live hardening posture for compliance reviews
Security settings with SSO, SCIM, 2FA and access review
Security: SSO (OIDC, SAML), SCIM provisioning, two-factor, password expiry, idle logoff, access review.

AI governance

  • Per-tenant AI governance: feature and model allowlists, blocked data classes, human-approval flags, private-endpoint override.
  • Redaction of emails, phone numbers and customer/user names before any prompt leaves the tenant; blocked and redacted events audited.
  • Evidence registry lists every AI feature, its model and a live prompt-template hash.
  • Eval suite that never counts mock output as a pass.
  • AI model-risk controls: a provider retention/no-training register that stays "self-declared" until someone e-signs that the contract was read; model approval (propose → review → approve/reject/retire) with segregation of duties and e-signatures; prompt-injection (10) and data-exfiltration (6) eval suites alongside the baseline, where a mock gateway scores "skipped" and never "pass"; a high-risk model cannot be approved without a passing live injection suite; the guard refuses any call naming an unapproved model once a workspace has registered one; scorecards and drift per model, surfaced in the trust controls.
Records lifecycle with retention and legal holds
Records lifecycle: retention per class, legal holds, audited full-tenant export.

Privacy & GDPR

  • GDPR erasure as a two-step e-signed workflow (report, then execute) covering users, customers and contacts.
  • Pseudonymises signature rows while leaving the audit trail intact, on a documented legal basis.
  • Subject-access export by email or username.
Hash-chained audit trail with verification
The audit trail: every action chained by hash, publicly verifiable, with facets, export and periodic review.

Accessibility

  • Skip-to-content, keyboard-operable sidebar, hubs, portal nav and top-bar controls.
  • Labelled icon buttons and inputs across the app.
  • Axe-core violations on the thirty most used screens went from 86 to 0.
  • An accessibility statement and VPAT-style table state the open items.
Validation kit with requirements traceability, IQ, OQ and PQ
Supplier validation evidence: our functional specification, our test specification, and our self-running test suite executed in your instance — plus the workspace where you build your own validation file.

Security evidence

  • Automated OWASP ZAP baseline and API scans plus npm audit across all services, repeatable by script, with results in the trust evidence API and the vendor assessment PDF.
  • SOC 2 Trust Services Criteria and ISO 27001 Annex A controls matrix mapping each control to concrete evidence in the product, stating plainly where a policy or certification is still required.
  • PDF-source controlled documents render byte-faithful to the signed original, watermarked, with the signature manifest appended as an extra page.
  • Still not certified: the matrix and scan evidence are inspectable controls, not a SOC 2 or ISO 27001 certificate.
  • Negative-test matrix: every live API operation (1,658) is probed for unauthenticated, wrong-tenant, portal-user, viewer, missing-e-signature, wrong-lifecycle-state and segregation-of-duties refusal (5,138 probes per run) with a reasoned allow-list of public routes and a CI gate; the first run found 222 findings, all fixed the same day (tenant-scoped parent checks on 119 routes, a signing route open to any role, an unsigned certificate path, a lifecycle rule). Current result: 0 findings at 71% coverage, with the uncovered operations named per run.
  • Negative-test matrix now covers 1,789 operations (5,844 probes) at 87% coverage with 0 findings; a per-release performance benchmark (seeded load generator, single-node numbers stated as such) is published on the trust page with a PDF report; record numbering and certificate issuance are race-safe under concurrent requests.
  • Second adversarial code review of the day fixed a privilege escalation (tenant admins could grant themselves superadmin through user updates), a silently accepted wrong e-sign password on PRT coefficient fits, a form-designer gate enforcing one of four rule kinds, double-signed concurrent package promotions, and four places where invalidated LIMS results still leaked into reports and statistics.
  • In-flight writes during a deployment receive a service-unavailable response with a retry hint rather than a misleading validation error.
Security settings with SSO, SCIM, 2FA and access review
Security: SSO (OIDC, SAML), SCIM provisioning, two-factor, password expiry, idle logoff, access review.

Release impact & observability

  • Every platform release gets a computed impact report (routes added or changed, affected OQ cases, suggested validation impact) and a downloadable release-impact pack PDF; OQ runs can be scoped to the cases a release affects.
  • Tenant audit trails, including every security event, can stream to a syslog collector (RFC 5424 over TCP/TLS) or to Splunk, Datadog or a generic HTTPS collector, batched and retried with a delivery log.
  • One dashboard shows live health, last success or failure and queue depth for every external connector; mTLS, OPC-UA, SAML and signing certificates are tracked with 30-day and 7-day expiry alerts.
  • The automated security baseline now also produces an SBOM, a dependency-vulnerability scan, static analysis and a secrets scan, folded into the trust evidence.
Records lifecycle with retention and legal holds
Records lifecycle: retention per class, legal holds, audited full-tenant export.

Accessibility (WCAG 2.2 AA programme)

  • Automated axe-core sweep of every application screen, the first record modal on each list page, the customer portal and the supplier portal (113 scans) runs as a CI gate together with a token-level contrast check; current result: 0 serious/critical automated findings. Automated checks catch only part of WCAG; a manual assistive-technology audit has not been done yet and is listed in the VPAT as a standing gap.
  • Certificates and reports are tagged PDFs (PDF 1.7, document language, title metadata, heading and table structure) for screen readers.
  • VPAT 2.5 (WCAG 2.2 A/AA) published with known standing gaps stated plainly; reduced-motion preference respected across the app and portals.
Hash-chained audit trail with verification
The audit trail: every action chained by hash, publicly verifiable, with facets, export and periodic review.

Validation evidence (IQ/OQ/PQ)

  • Our OQ, runnable in your instance, now carries 226 FS items and 284 executable cases across 36 modules — Z1.4 sampling, historians, PEPPOL, LIMS, serialization, ERP, warehouse egress, ISA-88, DCC signing, observability, content packs, capacity, EAM 2 and customs included; every compliance gate has a negative-path proof.
  • Latest deep run on a fresh tenant: PASS 284/284; not-applicable cases are reported separately and never counted as passes.
Validation kit with requirements traceability, IQ, OQ and PQ
Supplier validation evidence: our functional specification, our test specification, and our self-running test suite executed in your instance — plus the workspace where you build your own validation file.

Validation package (GAMP 5 / CSV)

  • A Validation Package workspace (Quality → Validation Package) holds the full vendor and customer document set: Validation Plan, System Design Specification, FS (supplier), Functional Specification, Configuration Specification, Functional Risk Assessment, IQ/OQ/PQ protocols and reports, Requirements Traceability Matrix, Test Summary, Deviation Summary, Validation Summary Report and per-release Release Risk Assessments.
  • Every document is a numbered, versioned record with a draft → review → approved → effective lifecycle; reviewer and approver must differ from the author (enforced server-side) and every step is a 21 CFR Part 11 electronic signature. Going effective supersedes the previous version automatically.
  • Documents are generated from live system state, never typed twice: 234 user requirements, 464 functional-specification items cross-referenced to the OpenAPI route families, and an RTM that ties each requirement to its risk class, test case and latest executed result with coverage by module.
  • Functional risk assessment: 124 platform functions scored severity × probability × detectability with GxP impact, ALCOA+ mapping, required test rigor and controls; editable per tenant; every entry cites verified FS and OQ ids and reports gaps honestly. Part 11 (17 clauses), Annex 11 (17), data-integrity (15) and vendor-questionnaire checklists are generated with real evidence routes and e-signed.
  • Executable Installation Qualification (service versions, schema, configuration checksum, TLS/CSP headers, backup and SBOM evidence, clock sync), expanded PQ on the tenant's own configuration, protocol pre-approval by e-signature (execution refuses an unapproved protocol version when the policy is on), automatic deviation records for failed cases with e-signed closure, targeted retest, release-scoped re-execution and run-to-run diff.
  • Every document renders to a PDF with a signature manifest and stored SHA-256; one click exports the whole package as a ZIP with a manifest and hash list plus the live IQ/OQ/RTM/PQ report. Periodic review runs on a configurable interval with a signed conclusion.
  • Ten vendor SOPs (CSV methodology, risk management, change control and release back-out, backup/restore and DR, incident and security, periodic review, customer data export and decommissioning, audit-trail review, training and competence, supplier assessment) ship as effective vendor-level documents, checked against the running system and adoptable into a tenant.
  • The validation package validates itself: 12 OQ cases prove segregation of duties, signature refusal, PDF hash verification, ZIP manifest integrity, generator consistency, deterministic risk scoring and the protocol pre-approval gate. The OQ kit now carries 234 FS items / 296 cases; not-applicable is an explicit flag enforced by a CI lint, never inferred from wording.
  • Risk defaults re-curated with written GAMP 5 / ICH Q9 reasoning per function (45 high, 52 medium, 27 low of 124); an e-signed reset restores vendor defaults without touching rows the tenant assessed. The OQ suite provisions its own test sessions in-process, so it runs back to back without tripping brute-force protection. Now 260 FS items / 327 cases.
  • An adversarial code review of the package found and fixed a segregation-of-duties bypass (a client-settable author field), a hash-verify endpoint that could not fail, an evidence-filing regex that demoted a real pass to not-applicable, and a Parquet integer overflow; reviewer and approver must now differ from each other as well as from the author, and protocol approval hashes case content rather than ids. The OQ kit stands at 315 FS items / 400 cases (deep run PASS 395 executed / 5 NA), and its own report states plainly that it is a vendor-run development gate, not independent qualification evidence.
Security settings with SSO, SCIM, 2FA and access review
Security: SSO (OIDC, SAML), SCIM provisioning, two-factor, password expiry, idle logoff, access review.

Data residency & customer-managed keys

  • Pin a workspace to a region: requests for a mismatched region are refused with 409 at the request layer; every outbound destination (warehouse, shipping, tax, payments, e-invoicing, accounting, mail, backup) is resolved to a region and refused if outside the allowed set, both when saved and when the call is made. A host whose region cannot be determined is refused until an administrator declares it (audited).
  • A data-location ledger built from the deployment's real configuration plus a subprocessor register, exportable as JSON and PDF; RTO/RPO are shown as targets until a restore drill is recorded.
  • Customer-managed keys: per-tenant AES-256-GCM envelope encryption of integration credentials and identified personal-data columns under a data key wrapped by a customer-supplied key; append-only rotation, on-demand re-key, seal (all reads refused until an e-signed emergency re-enable) and a per-operation key-use audit. Cloud KMS adapters are declared against the interface but not implemented; an honest data-class map lists every column that is not encrypted and why.
Records lifecycle with retention and legal holds
Records lifecycle: retention per class, legal holds, audited full-tenant export.

Low-code form & workflow designer

  • Configurable forms with sections, eight field types, calculated fields, conditional visibility, decision tables, required-evidence rules and transition validations, bound to CAPA, NCR, deviation, complaint, audit, risk and method status changes; the server gate now enforces all four rule kinds (required fields, visibility, evidence, transition validations) on the real transition, not only the advisory validate endpoint.
  • Versioned form definitions per environment (published versions immutable); config packages sealed with a content hash and promoted sandbox → production under an e-signature inside one transaction, with a risk-scored impact delta and proposed OQ cases per promotion.
  • Form rules are enforced on the server at record creation and on field edits, not only on status transitions, so a required field or a required piece of evidence cannot be bypassed by creating the record and editing it afterwards.
  • Closing-effectiveness reopening of a CAPA now runs through the same gated path as any other transition, so the flow matrix, the configured rules and signature rescission all apply to it.
Hash-chained audit trail with verification
The audit trail: every action chained by hash, publicly verifiable, with facets, export and periodic review.

Supplier audit

  • An audit room your auditor signs into with credentials we issue, time-boxed and read-only, with its own access log they can see
  • Our own gap register published to them first: what we have, what is partial, and what we have nothing for
  • Navigation by their checklist, clause by clause, where no answer can claim more than the gap register allows
  • Hashes, case-set comparisons and audit-chain rows they check themselves rather than accept
  • A signed per-release record of the gates that ran, tied to the build under test
  • A question channel in the room, answered and retained for the next auditor
Validation kit with requirements traceability, IQ, OQ and PQ
In the product Supplier validation evidence: our functional specification, our test specification, and our self-running test suite executed in your instance — plus the workspace where you build your own validation file.
Guards the system enforces

Things it refuses to do

A quality system is defined as much by what it will not accept. These are enforced in the platform, not in a procedure.

refuses

Sign by a model

Never. Every AI output is a draft until a person signs.

refuses

Delete a record

Records follow retention policy and legal holds; nothing auto-deletes.

refuses

Approve your own work under independent approval

Refused (409).

refuses

Edit a signed record without consequence

The signatures are rescinded and the rescission is audited.

Watch

Compliance, validation & security in under a minute

ISO/IEC 17025:2017 and 21 CFR Part 11 are not features bolted on; they are how the record works: a SHA-256 hash-chained audit trail, two-component electronic signatures bound to meaning, independent approval, supplier validation evidence — our FS, IQ, self-running OQ and test reports — plus your own PQ, retention policies and legal holds, SSO, SCIM and 2FA. Security headers, a tuned content-security policy, per-IP-and-tenant rate limiting and tightened request-size limits harden the API and web app, with a live headers-check endpoint for review.

Security settings with SSO, SCIM, 2FA and access review
In the product Security: SSO (OIDC, SAML), SCIM provisioning, two-factor, password expiry, idle logoff, access review.
Why it's different

Compared with what is out there

Built in

Compliance is how the record works, not a report bolted on.

The hash chain, the signatures and the verdict logic are the same code in the app, the certificate and the DCC.

Validation

The OQ runs itself.

Instead of a binder of screenshots, the operational qualification executes the checks, records the evidence and signs it — and you can re-run it after every change in hours, not weeks.

Beta

Beta means the product is still moving. The record is not.

Features ship in hours and days; the audit trail, signatures and certificate revisions are immutable by construction.

Beta · free while we build it with the first labs and plants

Bring one lab and your real history.

The tour runs the working platform, not a mockup. Pilot on your own instruments with your own imported history — we set it up with you, and fixes ship in hours and days, not release cycles.

Create your workspace, free Take the narrated tour