Trust at InnoQualis

InnoQualis operates an Electronic Quality Management System for regulated industries — medical devices, pharmaceuticals, and life sciences. This page documents our compliance posture, sub-processors, security stance, and audit-trail commitments so that customers and prospects can verify our claims without booking a sales call.

Current posture is mostly In Progress ahead of our Phase 26 cloud cutover. Items transition to Self-Attested as controls are implemented and to Validated as third-party audits complete.

Compliance posture

We target the following standards for the EQMS itself. Customers using InnoQualis to manage their own ISO 13485 / GMP programmes inherit our controls but operate under their own certifications.

Security overview

Data residency

InnoQualis's production infrastructure is moving to OVHcloud, hosted in its Frankfurt (Limburg) data centre in Germany, in the European Union. The provider and region are decided and the migration is under way; this page will drop the migration language once the cutover is complete.

• Primary region — OVHcloud, Frankfurt (Limburg), Germany, where compute and storage for the production platform are being provisioned.
• Backups — as part of the same migration, backup copies will be kept independently of the primary hosting provider: a nightly off-site copy with Hetzner Online GmbH (Germany) and a secondary copy with Backblaze B2 (EU region), so a single provider incident cannot take out the primary data and its backups together.
• EU member-state residency — if your procurement requires data to stay in a specific EU member state, raise it with us early; we are set up to have that conversation.
• Sub-processor data flows that traverse non-EU jurisdictions (e.g. OpenAI inference in the US) are governed by the Standard Contractual Clauses in each sub-processor's DPA. See the sub-processors table below for the routing of every data flow.
• Tenants with strict residency requirements can disable AI-Compliance-Officer features (which route prompts through non-EU LLM providers) at the workspace level.

Sub-processors

Per GDPR Article 28(2), we publish the full list of third parties that process tenant data on our behalf. We update this list before onboarding a new sub-processor.

Audit trails and retention

Quality records and audit trails follow 21 CFR Part 11 §11.10(e): append-only, tamper-evident, retrievable for the regulatory retention period.

• Every state-changing action on a controlled record (document, deviation, CAPA, change control, audit, training assignment) emits an immutable audit-trail row scoped to the tenant.
• Electronic signatures use soft-invalidation (invalidated_at + invalidation_reason) — never hard-delete. The full signing history of any record is always recoverable.
• Default retention: 10 years post decommission. This matches the upper bound of common medical device regulations (e.g. EU MDR Article 10(8); 21 CFR Part 820 §820.180(b)). Tenants in other regulated industries can configure a longer retention via support.
• Audit trails are tenant-isolated — cross-tenant queries are impossible by construction (every query layer enforces a tenant scope; tested at the integration layer).

Vendor support access

InnoQualis engineering staff (“vendor support”) can access an operational control panel to support your workspace — troubleshooting, account setup, subscription management. This is the same relationship as a cloud provider’s support staff to your cloud project: scoped to operations and analytics, never to the content of your quality records.

• Who can get in. A vendor support account is a separate account type, gated on three independent checks: an @innoqualis.com email domain, two-factor authentication, and an optional IP allowlist. A tenant’s own Admin account can never satisfy this gate.
• What vendor support can see. Aggregate analytics and user-management fields only: tenant name/plan/ active-user counts, record counts per module, and user directory entries (name, email, role). Vendor support does not see document bodies, deviation narratives, complaint descriptions, CAPA content, signature payloads, or any other quality-record content.
• The one exception. In-app support tickets your users submit through the feedback widget are, by design, addressed to InnoQualis support — support correspondence you initiated, not a quality record we’re reaching into.
• Every access is logged. Every request to the platform support surface writes an immutable, tamper-evident row to the same hash-chained audit-log table used for tenant records — operator identity, tenant touched, endpoint, method, and timestamp — kept distinct from your own audit trail. Available on request for an audit.
• Not yet built: time-bound access grants and proactive tenant notification of vendor access. On our roadmap; today the control is the access log above, available on request.

Incident history

No public-facing incidents to date.

Incidents that affect customer data, availability, or compliance posture are published at status.innoqualis.com (Phase 26.9 deliverable) with: short description, customer impact, timeline, root cause analysis, and remediation. We commit to publishing within 72 hours of incident resolution.

Compliance officer contact