Quality management

Control documents, sign them and keep every step traceable.

Control SOPs and forms, train your team and handle deviations, CAPA and change control in one system. Electronic signatures, a complete audit trail and sealed documents in WORM storage are part of it. The module supports the requirements of 21 CFR Part 11 and EU GMP Annex 11 and is designed for GMP, GACP, HACCP and ISO 9001.

Features

Six building blocks, one continuous audit trail.

Controlled documents

A document only becomes effective once its sealed PDF/A rendition exists. You edit it in the web editor or in Word, Excel and PowerPoint as before.

Cleaning of filling line ASOP-PR-0031 · Rev. 4
  1. AuthoredM. Albers
  2. Technically reviewedK. Yilmaz
  3. Approvedpending
  4. QA release—
Block diff: 3 sections changed2 review comments

Electronic signatures

Under 21 CFR § 11.200, with re-authentication and 18 signature meanings.

Hash-chained audit trail

Append-only, anchored daily in three places, verifiable at the click of a button.

  1. Signature · Approved14:12:089f3a…c21e ← 4b07…e9d2
  2. Classification changed14:10:514b07…e9d2 ← d18c…07af
  3. Batch 26-0412 blocked14:02:17d18c…07af ← 61e4…b350
  4. Deviation recorded13:58:4061e4…b350 ← anchor 6 Oct

Training & qualification

Only trained people can carry out a step, enforced automatically by the qualification lock.

Deviation, CAPA, change control

Reported by smartphone, investigated with 5 Whys and Ishikawa, linked all the way to the change.

Standard packages & validation

Preconfigured, with a compliance matrix and a validation package following GAMP 5 category 4.

GMPGACPHACCPISO 9001ISO 27001
ClauseEvidence in the system
ISO 9001 · 7.5.3Document control, SOP-QA-001 effective
EU GMP Annex 11 · 9Audit trail, hash chain verified
21 CFR 11.50Name, time and meaning on every rendition
Configurable

Fully configurable, with templates from the standard package.

Metadata, workflows and forms are fully configurable in the system. Every standard package comes with sensible examples that already reflect the regulatory requirements. Adopt them as a starting point or adapt them to your operation.

Metadata
Fields, mandatory entries, number ranges and review intervals per document type
Workflows
Stages, roles and signature meanings, in parallel or in sequence
Forms
Fields, validation rules and signatures, optionally four-eyes

Every configuration change is versioned and released by signature, so the configuration itself stays auditable.

Document type SOPVersion 4 · Draft · Based on: GMP package
FieldRuleOrigin
Document numberSOP-{Area}-{0000}Standard package
ScopeMandatoryStandard package
Periodic review24 monthsStandard package
Responsible departmentMandatory · listStandard package
Risk classA · B · CCustomised
1 field added to the standard packageSign for release
StageSignature meaningOrigin
AuthoredAuthoredStandard package
Technically reviewedTechnically reviewedStandard package
Occupational safetyReviewed · parallelCustomised
ApprovedApprovedStandard package
QA releaseQA releaseStandard package
1 stage added · author ≠ reviewer enforcedSign for release
FieldTypeOrigin
Date and timeTimestampStandard package
BatchMandatory · formatStandard package
Remaining cleaning agentNumber · litresCustomised
Performed bySignatureStandard package
Checked bySignature · ≠ performerStandard package
Cleaning record · serial number per printoutSign for release
Workflow

From draft to inspection.

Every step is tied to linked records with a signature and an audit trail.

01

Create the document

You start from a controlled template with mandatory sections. Edit it in the structured web editor with steps, warnings and parameters, or file-based in Word, Excel or PowerPoint with check-out/check-in.

Editing
Web · Office
File explorer
WebDAV
Pictograms
GHS · ISO 7010
02

Review and sign

The approval workflow runs from "Authored" to "QA release", in parallel or in sequence. Reviewers see changes as a block diff and comment directly; every signature requires re-authentication.

Stages
4
Comparison
Block diff
Rule
Author ≠ reviewer
03

Seal and make effective

On approval, the database locks the revision. vemix creates a PDF/A rendition with an approval sheet, seals it, applies a timestamp and stores it in WORM storage.

Format
PDF/A-2b
Seal
PAdES B-LT
Timestamp
RFC 3161
04

Train

The new revision goes to the recipient groups, for information or as training with minimum reading time, knowledge test, oral assessment or practical assessment. Reminders and escalation run automatically.

Training types
4
Effectiveness check
90 days
Escalation
automatic
05

Print under control

Numbered controlled copy, information copy or form with a serial number, always with a print reason. The QR code on every page shows whether the revision is still effective.

Copy types
3
Verification
QR per page
Print reason
mandatory
06

Report a deviation

Anyone can report a deviation in the mobile app, even without a QM role. QA classifies it, sets an investigation deadline and blocks the batch if needed.

Photos
up to 10
Deadlines
15 · 30 · 60 days
Recurrence
12 months
07

CAPA and change control

The linked CAPA is created from the investigation with one click. If a document has to change, the impact assessment shows which documents, forms and training are affected.

Loop: leads back to 01 Create the document when needed and starts a new revision.

Analysis
5 Whys · Ishikawa
Actions
Sub-records
Board
unanimous
08

Review and inspection

Before closing, you review the record's audit trail and sign "Audit trail reviewed". Inspectors get read-only access with an expiry date.

Review
signed
Inspector
read only
Export
PDF/A · CSV
In detail

What the QM module can do.

Document control

  1. 01Structured web editor with sections, steps, warnings (GHS/ISO 7010 pictograms) and parameters
  2. 02File-based with Word, Excel and PowerPoint: check-out/check-in, editing in the file explorer via WebDAV ("QM/My drafts")
  3. 03Block diff, side-by-side comparison, review comments and a "referenced by" list
  4. 04Library with page-exact full-text search; controlled viewer with watermark, every view logged
  5. 05Periodic review (task 60 days before due date), supersession, signed withdrawal and translations

Electronic signatures

  1. 0118 signature meanings, from "Authored" through "QA release" to "Audit trail reviewed"
  2. 02First signature per session with user ID and password, then password; TOTP or step-up via Microsoft Entra ID
  3. 03Lock after three failed attempts with an instant alert, MFA required per workspace, idle timeout of the QM session
  4. 04Signature commitment before the first signature, signing authority per person, delegation ("on behalf of")
  5. 05Segregation of duties: author ≠ reviewer, performer ≠ checker

Audit trail & archive

  1. 01Append-only with a hash chain; database triggers prevent changes and deletions
  2. 02Daily anchor in three places plus RFC 3161 timestamp, chain verification on demand, alert on breach
  3. 03Mandatory reasons from a catalogue, plain-language labels, export as PDF/A, CSV and JSON
  4. 04Signed review per record or period, with filters such as "changes after release" or "outside working hours"
  5. 05WORM storage with S3 Object Lock in compliance mode, legal hold and signed destruction approval

Training & qualification

  1. 01Recipient groups, distribution "for information" or "training required", recurring training
  2. 02Self-study with minimum reading time, server-scored knowledge test, oral assessment, practical assessment
  3. 03Classroom sessions with collective assessment under one signature, confirmation on the trainer's device
  4. 04Qualification lock, retraining after a failed test, delayed effectiveness check
  5. 05Qualification matrix, training file per person, "My team" and record exports as PDF/A and CSV

Deviation, CAPA & change control

  1. 01Deviation from "Recorded" to "Closed" with 5 Whys, Ishikawa and batch block
  2. 02Reporting by smartphone for everyone, with up to ten photos and status under "My reports"
  3. 03Recurrence detection over twelve months, deadline extension only with a reason
  4. 04CAPA with actions as sub-records, plan review and a scheduled effectiveness check
  5. 05Change control with impact assessment and board; closure only once revisions are effective and copies returned

More processes & cockpit

  1. 01Complaints, supplier evaluation, internal and external audits with findings → CAPA
  2. 02Management review, equipment with calibration and maintenance, periodic access review
  3. 03Electronic batch record (eBR), QC test records with OOS/OOT, HACCP CCP monitoring
  4. 04Versioned record types and workflows in the visual designer, configuration released by signature
  5. 05QM cockpit with KPIs, link graph and a "QM" tab on suppliers and customers in the CRM

Standard packages, validation & AI

  1. 01Standard packages GMP, GACP, HACCP, ISO 9001 and ISO 27001 with document types, workflows and templates
  2. 02Compliance matrix: clause number → evidence in the system
  3. 03Validation package following GAMP 5 cat. 4: URS template, risk assessment, traceability matrix
  4. 04OQ test reports and release notes per version, at least 30 days' notice, activation per workspace
  5. 05AI assistance can be switched off per workspace: suggestions flagged, model name in the audit trail, AI never signs
Integrated

Quality, connected to the whole operation.

  • CRM"QM" tab on suppliers and customersComplaints and supplier evaluation right on the contact.
  • Mobile appReport deviations at /mIn the same app your team uses to track time.
QMone audit trail for every link
  • TasksCentral task inboxReviews, training and copy retrievals alongside all other tasks.
  • Global searchRecords and document contentPage-accurate full-text search across the entire library.
FAQ

You validate. We supply the controls.

There is no regulatory Part 11 certification for software. vemix provides the technical controls and the validation package following GAMP 5 category 4, with OQ test reports for every release.

Is vemix certified under 21 CFR Part 11?

No. There is no regulatory Part 11 certification for software. 21 CFR Part 11 and EU GMP Annex 11 are addressed to you as the regulated company: you validate the system for your intended use and operate it with your own SOPs and trained staff. vemix supports the requirements with the technical controls (electronic signatures under 21 CFR § 11.200, a hash-chained audit trail, WORM storage) and provides the validation package following GAMP 5 category 4 with a URS template, risk assessment, traceability matrix and OQ test reports for every release.

Can I start with quality management only?

Yes. The Quality Management edition includes quality management without the CRM. You can add more modules such as the CRM, projects, contracts or signatures later without switching editions. Your QM data stays unchanged. Current prices are on the pricing page.

Which standards and regulations is the module designed for?

For GMP (EU GMP guidelines and 21 CFR 210/211), GACP (EMA GACP and EU GMP Annex 7, e.g. for medicinal plants and medical cannabis), HACCP (Codex Alimentarius principles, Regulation (EC) 852/2004), ISO 9001 and ISO 27001 with a statement of applicability. Each standard package comes with preconfigured document types, workflows and templates. A compliance matrix maps each clause number to the evidence in the system.

Can I keep working in Word?

Yes. Alongside the structured web editor there is a file-based mode: Word, Excel and PowerPoint documents are created from a controlled template and edited via check-out/check-in, optionally right in the file explorer via the WebDAV drive in the "QM/My drafts" folder. Approval, sealing as PDF/A and training work exactly as in the web editor.

Does the AI sign or decide anything?

No. AI assistance can be switched off per workspace and is off by default. It suggests SOP drafts, change descriptions from the diff, test questions, root-cause analyses and impact assessments, and every suggestion is flagged as an "AI suggestion". If you accept one, the model name is recorded in the audit trail. The AI never signs and never triggers a workflow transition.

How do inspectors and auditors get access?

Through the QM inspector role: read-only access with an expiry date ("access until") and an "Inspection · read only" banner on every page. The inspector sees documents, records and the audit trail but cannot change anything. You can additionally export evidence such as the audit trail, training files or the qualification matrix as PDF/A.

Where is my data stored?

In Scaleway data centres in France (EU), with a separate database for each company. Sealed documents, printed copies, attachments and audit trail anchors are kept in a dedicated WORM bucket with S3 Object Lock in compliance mode. Retention there can only be extended, never shortened. Once retention expires, destruction requires a signed approval, and at the end of the contract you receive a full export.

How do updates affect my validation?

Every QM version comes with release notes and OQ test reports from more than 170 automated tests with requirement IDs. We announce changes at least 30 days in advance, and you activate new versions per workspace. That way you assess every change before it takes effect in your system.

Can staff without a QM role report deviations?

Yes. In the mobile app at /m, anyone can report a deviation via the "Report" tab, with up to ten photos. Under "My reports" they see the status; QA is notified immediately and takes over classification and investigation.

Control your SOPs digitally.

Start with a standard package, bring your SOPs as Word files or in the web editor, and take your first revision through review, signature and training.

Start your free trial