Validation & compliance

Evidence to support your validation, and a clear line on who validates what.

How Invariant supports your validation and regulated use.

Shared responsibility

Invariant is built to 21 CFR Part 11 and EU Annex 11 expectations and is designed to support your intended-use validation under a shared-responsibility model:

Elevated Signals

Qualifies the platform — infrastructure, data segregation, audit integrity, and the shipped verification tooling.

Your organization

Validates its configured intended use (risk-based, aligned to FDA CSA).

Invariant is not certified, validated or compliant on your behalf: validating it for your intended use stays your programme’s decision, and we will walk your QA team through the evidence behind any claim on this page.

21 CFR Part 11 / EU Annex 11

A summary of how Invariant controls map to Part 11 / Annex 11 expectations. The full, maintained matrix — with an honest Implemented / Partial / customer-responsibility status per control — is Validation Accelerator Pack artifact A3.

Expectation	Invariant control
Audit trail (who/what/when/why)	Per-org hash-chained, tamper-evident audit with reason-for-change
Electronic signatures	Signer identity, timestamp, meaning, credential re-verification, content binding
Signature/record linking	Signatures bound to content digest + linked audit entry; append-only
Access controls	Role-based access with organization scoping
Copies / exports	CSV/PDF exports via a versioned metric contract

“Built to Part 11 / Annex 11 expectations” describes designed controls and tested behavior. It is not a statement that a deployment is certified or validated — that remains program specific.

Data integrity (ALCOA+)

How Invariant supports ALCOA+ data-integrity principles.

ALCOA+ principle	Invariant support
Attributable	Every action records the actor (human/AI/system) and organization
Legible	Structured records; human-readable audit trail
Contemporaneous	Audit entries written atomically with the business change
Original	Source records retained; exports are derived copies
Complete	Reason-for-change on regulated edits; linked records
Consistent	Enforced lifecycle ordering + hash-chained sequence
Enduring	Append-only audit + signatures
Available	Verifiable on demand; exportable

Authoritative statement: Validation Accelerator Pack artifact A8.

Validation Accelerator Pack

Several artifacts are pre-filled templates your QA team adapts to your intended use.

No.Artifact · what it is for

System Overview & Intended Use StatementWhat Invariant is, and the intended use your validation starts from.

GAMP 5 Software CategorizationThe software category to anchor your risk-based approach.

21 CFR Part 11 / Annex 11 Compliance MatrixEach expectation with its control and an Implemented, Partial or your-responsibility status.

Risk Assessment (pre-filled template)A starting risk assessment your QA team adapts to your configuration.

OQ Test Script SetScripts for the operational qualification of your configured workspace.

Audit Trail & Tamper-Evidence Technical StatementHow the hash chain and the verifier work, and what a passing check does not prove.

Tenant Isolation / Data Segregation StatementHow your data is kept separate, with the repeatable isolation proof.

Data Integrity (ALCOA+) StatementHow the system supports each ALCOA+ principle.

Supplier Qualification / Security SummarySupplier information for your vendor qualification file.

A10

Release & Change Management ProcessHow releases are classified, documented and regression-tested.

The authoritative pack content is maintained internally, versioned with each release, and provided during evaluation.

Book a demo

In the documentation

21 CFR Part 11 / EU Annex 11 Audit trail & tamper-evidence Multi-tenant data segregation Data integrity (ALCOA+)Security & trust