Case study · Compliance · 21 CFR Part 11

The result matters. So does being able to reconstruct it.

Regulated work needs a clear record of who did what, when, and with which instrument output. The GIMS Compliance Relay captures that evidence as the work happens.

Instead of relying on handwritten records to connect instrument files, operators, and approvals, the Relay watches an export folder, records new files, and links captures, reviewer access, signatures, and exports in one ordered trail.

Active pharma pilot21 CFR Part 11FastAPI · Tauri · Postgres or SQLite

Open the demo ↗The engineering report →

The problem

An instrument produces a file, but a person still has to connect it to an operator, a review, and the records needed later.

What changed

File capture, attribution, electronic signatures, and sealed exports share an append-only record stream with verifiable integrity.

Why it matters

Reviewers can follow the evidence and re-verify exported records offline. The controls support regulated workflows without making staff reconstruct the history by hand.

Architecture / compliance-relayThe design behind the outcome

Controls that follow the work.

The two-tier design separates the instrument edge from the server of record. Keyed HMAC chaining makes changes detectable; identity, signature, and export events share the same trail. The implementation addresses record integrity and traceability in a 21 CFR Part 11 context. The engineering report documents the controls and their verification.

Walking the demo sign in · watch a folder · a capture lands · verify · sign · export

The Compliance Relay demo on first visit: the sign-in card dimmed behind the gnome's welcome bubble, step 1 of 10

gims-compliance-relay-demo.vercel.appfirst visit: the tour starts itself

Sign in as a reviewer

Viewing the regulated trail needs an authenticated reviewer. The tour fills in a reviewer’s email and password, and from there each step performs the real action through the mock, so the trail visibly grows the way the live product’s does.

The demo is a static site: no server, no serverless function, no build step. It shows what the product does, not how. The mechanisms that make the real product defensible are deliberately not present in it.

Watch a folder; a capture appears

A trail is a study or batch, its own append-only record stream. The tour points the relay at /instrument/hplc/exports. The moment a folder is watched, a simulated instrument file is captured and logged to the top of the trail, under the operator’s OS identity: kind, operator, what, checksum.

Then Verify. In the real product this re-walks a keyed, tamper-evident chain; in the demo it is cosmetic, and the header pill turns green.

The Relay dashboard after a capture: the trail table with a new FILE CAPTURE row for dissolution_v4.csv spotlighted at the top, the gnome's bubble reading A capture appears

gims-compliance-relay-demo.vercel.app · step 5 of 10the trail, one capture in

The electronic signature dialog: record checksum, email, password, a meaning of Approved, and a reason field, with Sign and confirm

gims-compliance-relay-demo.vercel.app · step 8 of 10the signing dialog · 21 CFR Part 11 §11.200: re-authenticate to sign

Sign a record

Reviewers bind an electronic signature to a record. Part 11 requires re-entering your password to sign, so the dialog asks for it again, with a meaning (approved, reviewed, rejected) and a reason. The signature lands on the trail as its own record, linked to the one it signs.

The finished Relay dashboard: Chain verified · 26, the file watcher, the export panel, and the full trail of captures, signatures, access, and system records

gims-compliance-relay-demo.vercel.app · after the tour26 records, chain verified

The export step: the gnome's bubble reading Export the evidence, pointing at the CSV and JSON buttons

gims-compliance-relay-demo.vercel.app · step 9 of 10export the evidence: CSV or JSON, watermarked as simulated

The production product exports a signed evidence package that an auditor can re-verify offline, without access to the live system. The demo’s exports are watermarked as simulated so they cannot be mistaken for a real record.

Photo: Pavel Danilyuk, Pexels · decoration: the clipboard is what the trail replaces

Under the hood defensibility first

From cosmetic compliance to a tamper-evident Part 11 relay.

A ground-up rebuild of a copy-paste-grown FastAPI + Tauri app, whose compliance guarantees were largely decorative, into a lean, defensible Part 11 logging service: one append-only HMAC-chained trail, non-forgeable attribution, real two-component e-signatures, provider-neutral storage, and a two-tier edge → server-of-record custody model. Then a second pass that closed the twelve lagging §11.x edges the design described but the code had not yet delivered.

The constraint that shaped it: Part 11 defensibility first. The integrity spine was hand-built and hand-tested; breadth was built by multi-agent workflows; and every claim of “this control actually holds” was put through an adversarial verification pass whose only job was to refute it. That pass is how the two deployment-breaking bugs in the report were caught before shipping.

Read the full engineering report →

What holds

One append-only trail, HMAC-chained, re-verifiable end to end
Non-forgeable attribution: captures under the operator’s identity
Two-component electronic signatures, re-authenticated at signing §11.200
Provider-neutral storage: five storage ports, local and AWS live
Edge → server-of-record custody; grant-denied writes fail loudly SQLSTATE 42501

Residual risks, stated plainly

Forwarded-path attribution trust rests on the shared trail HMAC key: the server proves a key-holder sealed a record, not which human
The local-mode notary is an operator-owned filesystem anchor unless S3/MinIO object-lock is configured
The product is, accurately, “designed to support 21 CFR Part 11”; formal computer-system validation is the customer’s responsibility, as intended

Status, honestly

The Relay is in an active pilot with a pharma company. It is built to a real regulatory standard rather than a generic audit log; the compliance detail is the product. The stage it is at: a demo that shows the workflow, a defensible core that has been adversarially verified, and a live sales conversation, being pushed toward a first production deployment.

Put the engineering in context

Recognize a problem in your own workflow?

Show me one task your team does by hand. In 20 minutes, I’ll tell you if it’s worth automating and what it would cost.

Book a free 20-minute check Explore the other projects →