New: Quality management

Quality management has arrived in vemix. With the new module you control SOPs and forms, train your team with evidence, investigate deviations and take CAPA and changes through to an effective close. It is designed for GMP, GACP, HACCP and ISO 9001.

Why quality management belongs in the suite

In many smaller businesses, quality management lives in Word files, Excel lists and binders on a shelf, or in a separate system that knows nothing about the rest of the data. Yet quality depends on the same things as the rest of the work: people who need to be trained, suppliers who are evaluated, tasks with deadlines and documents that someone has to find.

In vemix, quality management uses exactly this shared data. Employees are the same users as in projects and time tracking, suppliers and customers from the CRM carry their own “QM” tab, QM tasks land in the central task inbox, and global search finds records and document content. You maintain all of this only once.

Document control: effective only with the sealed rendition

You work the way that suits your document. In the structured web editor, an SOP is built from blocks: sections, work steps, warnings with GHS and ISO 7010 pictograms, and parameters. You see changes as a block comparison, and reviewers comment directly on the text. If you prefer Word, Excel or PowerPoint, you create the document from a controlled template, check it out and edit it straight from Explorer through the WebDAV drive.

Approval runs through a workflow, by default Authored → Subject-matter reviewed → Approved → QA release, which you can adapt. From approval onwards, the database locks the revision. vemix then produces a PDF/A rendition with an approval sheet, seals it with your company’s seal certificate, adds an RFC 3161 timestamp and stores it in WORM storage. Only once this sealed rendition exists does the document take effect: immediately, after a delay, on a set date, or only once a defined share of the people concerned has been trained.

Reading happens in the controlled viewer with a watermark, without download and without print; every view is logged. The periodic review shows up as a task 60 days before it is due and ends with a signed “still valid” or “revision required”.

Electronic signatures and audit trail

Signing follows 21 CFR § 11.200: the first signature in a session with user ID and password, every further one with the password. Anyone signing in through Microsoft Entra ID additionally confirms with an enforced re-authentication. After three failed attempts, the account is locked and an alert goes out immediately. Before their first signature, every person confirms a statement of accountability, and you decide per person which meanings they may sign. Name, time and meaning, such as “Approved”, “QA release” or “Read and understood”, appear on every signed record and every rendition.

The audit trail is append-only: each entry is linked to the previous one by a hash chain, database triggers prevent changes and deletions, and a daily anchor is stored in three places and timestamped. You can verify the chain with one click. Changes require a reason, and the review of the audit trail is itself a signed step, per record or per period.

This is how vemix supports the requirements of 21 CFR Part 11 and EU GMP Annex 11. A system only becomes compliant in your operation: through validation, your own SOPs and training. We provide the tools for that too; more on this below.

Training with evidence

You distribute a new or changed document to recipient groups, either “for information” with an acknowledgement or as “training required”. That ranges from self-study with a minimum reading time and the signature “Read and understood”, to a knowledge test drawn from an approved question pool and scored on the server, to a practical assessment with a checklist on the job. In classroom sessions, participants confirm on the trainer’s device, and the assessment is recorded collectively under one signature.

The qualification lock ensures that only trained people execute a workflow step. It either blocks the step or shows a warning. Failing a test leads to retraining, and the effectiveness check follows after 90 days by default. The qualification matrix, the training record per person and the “My team” view for managers show where things stand, and you export evidence as CSV or PDF/A.

Print control

Most businesses still use paper, so paper is controlled. A controlled copy is numbered, an information copy carries the note “valid only on …”, and forms are issued with a serial number. A reason for printing is mandatory, and print rules per document type limit the number of open copies. Each copy is its own PDF with a QR code on every page and can be downloaded exactly once. Anyone scanning the code sees at once: “This revision is effective” or “SUPERSEDED – do not use”. When a revision is superseded, recall tasks are created for the copies that were issued.

Deviations from a smartphone, CAPA and change control

A deviation is usually noticed where there is no desk. That is why anyone, even without a QM role, can report a deviation with up to ten photos under “Report” in the mobile web app and follow its status under “My reports”. QM is notified and takes the case from Recorded through Classified and Under investigation to Assessed and Closed. This includes 5-Why and Ishikawa, a batch lock, an investigation deadline per classification and a notice when the same deviation recurs within twelve months.

If a CAPA is needed, it is created linked to the deviation. Corrective and preventive actions run as sub-processes, the plan is reviewed and starts on approval, and the effectiveness check gets a fixed date. In change control, the impact assessment shows which documents, forms and training are affected. The change control board has to agree unanimously, and the change is only closed once the new revisions are effective and the old copies have been returned. Complaints, supplier evaluation, internal and external audits, management review and equipment with calibration and maintenance build on the same record and workflow engine.

Standard packages and validation package

As a starting point, the module comes with standard packages: GMP (EU GMP guidelines and 21 CFR 210/211), GACP (EMA GACP and EU GMP Annex 7), HACCP (Codex Alimentarius principles and Regulation (EC) No 852/2004, including CCP monitoring against critical limits), ISO 9001 and ISO 27001 with a statement of applicability. Each package contains preconfigured document types, workflows and templates as well as a compliance matrix that maps every clause number to the evidence in the system.

For validation, there is a validation package following GAMP 5, category 4, with a URS template, risk analysis and traceability matrix, plus OQ test reports for every release from more than 170 automated tests with requirement IDs. We announce new QM versions at least 30 days in advance and enable them per workspace, so your validated state is preserved.

There is AI assistance here as well, but it is restrained: it can be switched off per workspace and is off by default, every suggestion is marked as such, and the AI never signs and never triggers a transition. Through MCP and the API, the module is read-only.

Who it is for

We have written one solution page for each industry the module is designed for:

• Pharma & biotech: GMP quality management alongside project costs and NDAs.
• Food businesses (HACCP): HACCP plan, hygiene training, CCP monitoring and deviations.
• Cannabis & medicinal plants (GACP): GACP and GMP from cultivation to release.
• ISO 9001 for SMEs: quality manual, document control, training, CAPA and audits in one system.

You will find all the details on the module page. The quickest way to get to know the module is a live demo or the free trial.