GxP Compliance & Security
Built to be inspected.
OneXPro is designed for GxP-regulated records and to support compliance with FDA 21 CFR Part 11, EU GMP Annex 11 and ALCOA+ data integrity expectations. This page explains how each control works — and, just as importantly, what remains your responsibility.
GxP
One standard of evidence across your GxP records.
“GxP” covers the good-practice regulations that govern how medicines are made, tested and documented. Wherever a record is GxP-relevant, regulators expect the same things: controlled access, attributable signatures, a complete audit trail and data that cannot be quietly changed. OneXPro applies those controls to every record, whichever practice it falls under.
GMP — manufacturing
Change control, batch-related calculations, equipment and maintenance records — under 21 CFR Parts 210/211, EU GMP and India's revised Schedule M.
GLP & QC laboratories
Laboratory result sheets, stability data and trend workbooks reviewed and signed record by record, with the original file preserved.
GDocP — documentation
Good documentation practice built in: contemporaneous entries, no overwriting, every correction attributable and explained by its trail.
Data integrity guidance
Aligned with the expectations of FDA, EMA, MHRA (GxP Data Integrity Guidance), PIC/S PI 041 and WHO data integrity guidance.
21 CFR Part 11
Control by control.
How the software addresses each technical requirement of Part 11 for closed systems.
| Clause | Requirement | How OneXPro supports it |
|---|---|---|
| §11.10(a) | Validation | A versioned validation package (plan, URS, FRS, DS, IQ/OQ/PQ protocols, traceability matrix, summary report). Validation for your intended use is performed by you, with our support. |
| §11.10(b) | Accurate and complete copies | Records print as PDF in the form's own layout with the complete audit trail appended; audit trails export as CSV or JSON. |
| §11.10(c) | Protection of records | Records are never deleted — a numbered change control can only be discontinued. Records and attachments are retained when a user account is removed. |
| §11.10(d) | Limiting system access | Personal accounts only, created by the company admin. Access by feature, role and department; other departments' records are not visible. |
| §11.10(e) | Audit trails | Computer-generated, time-stamped, append-only. Each change keeps the previous and new value, and is written in the same transaction as the change itself. Spreadsheet Review chains each entry by hash. |
| §11.10(f) | Operational checks | Steps are enforced in sequence: a section opens at its stage and its boxes sign in order. A section with errors cannot be signed off. |
| §11.10(g) | Authority checks | Who may fill and sign each step is configured by the company admin and enforced on the server. Approval boxes require a named signer. |
| §11.10(k) | Documentation controls | Validation documents are versioned with the software and updated in the same change as any documented control. |
| §11.50 | Signature manifestations | Every signature shows the signer's printed name, designation and department at that moment, the meaning of the signature, and the date and time. |
| §11.70 | Signature/record linking | Signatures are stored inside the record they sign and freeze what they attest to; they cannot be copied to another record. |
| §11.100(a) | Uniqueness | One person, one account. Accounts are disabled, never deleted or reassigned, and a username is never issued twice. |
| §11.200(a) | Signature components | Each signature requires the user's own identification and password, re-entered at every signing. |
| §11.300 | Controls for credentials | Strong password policy, temporary passwords replaced at first sign-in, lockout after 5 failed attempts, and every administrator reset recorded and flagged on later signatures. |
EU GMP Annex 11 · GAMP 5
Risk-based, validated, reviewable.
The same controls address the principles of EU GMP Annex 11 for computerised systems: validation, data integrity checks, audit trails, change and configuration management, security, electronic signatures and data availability.
- Validation (Annex 11 §4): versioned URS/FRS/DS and IQ/OQ/PQ protocols with a traceability matrix.
- Audit trails (§9): every GMP-relevant change recorded with who, when and the previous and new values — with the reason wherever the workflow asks for one.
- Change & configuration (§10): spreadsheet permission changes are drafted, described in plain sentences and published with a reason and change-control reference; account and configuration changes are recorded.
- Security (§12): personal accounts, role-based access, lockout and an account audit trail.
- Electronic signature (§14): permanently linked to the record, with date and time.
Data integrity
ALCOA+, in practice.
| Attributable | Every entry and signature is tied to a unique, verified user account. |
| Legible | Records are readable on screen and as PDF; audit reports are written in words, not codes. |
| Contemporaneous | Times come from the server clock, shown in your site's time zone — never from the user's device. |
| Original | Spreadsheets are frozen on upload with a SHA-256 fingerprint; signed sections cannot be overwritten. |
| Accurate | Field-level validation and deterministic checks block signatures on incomplete or inconsistent data. |
| Complete | Nothing is deleted; history and before/after values are kept in full. |
| Consistent | Every screen, report and notification reads the same calculation, so they cannot disagree. |
| Enduring | Records and attachments are retained, including when accounts are removed. |
| Available | Records and audit trails can be reviewed, printed and exported for inspection at any time. |
Security
How your data is protected.
Isolated per company
Each customer has its own database and its own storage bucket, with access rules generated for that company alone. Every request is bound to your company by a verified sign-in token.
Google Cloud infrastructure
Hosted on Google Cloud (Firebase) infrastructure, with the data region chosen when your company is set up.
Encryption
Encrypted in transit with HTTPS and HTTP Strict Transport Security, and encrypted at rest by the underlying cloud platform.
Authentication
Strong password policy, first-sign-in password change, lockout after 5 failed attempts for an hour, and password re-entry for every signature.
Least privilege
Company admins grant features per user; departments and flows narrow what each person can see and do. Nobody signs a box they are not assigned to.
Hardened web application
Content Security Policy, anti-framing, no-sniff and strict referrer headers on every response. Server-side enforcement of every rule — the browser is never trusted.
Server-only data access
Record collections are closed to direct browser access; all reads and writes pass through checked server routes.
Governed AI
AI drafting is optional, runs only on our servers, never signs, and is refused before any model call when the user may not edit the field. It cannot introduce document numbers that are not already in the record.
Privacy by design
We collect only what is needed to run the service. See our Privacy Policy for how personal data is processed and your rights.
Shared responsibility
Software supports compliance. Your quality system achieves it.
No software is “Part 11 compliant” on its own. Regulators hold the regulated company accountable for how a system is validated and used.
OneXPro provides
- The technical controls described on this page
- A versioned validation package and release documentation
- Secure, isolated hosting and operation of the service
- Implementation, validation support and training on request
You remain responsible for
- Validating the system for your intended use (IQ/OQ/PQ)
- SOPs for access management, e-signature use and audit-trail review
- Training records for every user (§11.10(i)) and written accountability policies (§11.10(j))
- Certifying your use of electronic signatures to the FDA (§11.100(c))
- Who you appoint as administrators, and periodic review of their actions
OneXPro does not claim any third-party certification on this page. If your supplier qualification requires a questionnaire or audit, contact us.
Preparing for an audit or a supplier qualification?
Ask for our validation package and security questionnaire responses.