Security, compliance, and regulatory posture

Regulatory framework alignment

21 CFR Part 11 — specific controls

• Unique user IDs. Each user account is uniquely identified. Shared login credentials are prohibited by the access control model. Auth module — roadmap
• Secure, computer-generated, time-stamped audit trails. Every create, update, approve, generate, and verify action writes an immutable row to audit_events with actor, action type, target record, timestamp (UTC), and SHA-256 content hash. Audit rows cannot be modified or deleted by any application user or API call.
• Sequence of events reconstructible. The smpc_section_versions table is append-only. Every prior state of every section is retained with content hash and change notes, enabling full reconstruction of the record at any point in time.
• Record retention. Audit events and version history are retained for the life of the tenant plus 10 years. Deletion of tenant data requires a formal data erasure request and is logged in the audit trail.
• Electronic signature manifestation. Approval actions record the approver identity, timestamp, and the SHA-256 hash of the exact content approved. Signature infrastructure (hardware token / PKI binding) is on the roadmap. E-sig binding — roadmap
• Operational system checks. The /health endpoint and Render uptime monitoring provide continuous availability verification.

EU Annex 11 — specific controls

• Risk-based validation approach. Veracore is classified as a direct-impact computerised system (GxP-relevant product information). A validation plan, IQ/OQ/PQ documentation, and a traceability matrix are available to customers. See Validation Support below.
• Supplier assessment. Infrastructure sub-processors (Render, Neon) are assessed for SOC 2 / ISO 27001 compliance. See Sub-processors below.
• Change control. All schema changes are executed via numbered migration files (migrations/<timestamp>_<name>.sql). Application code changes are version-controlled in Git with tagged releases. No undocumented schema changes are possible at runtime.
• Periodic review. The audit log provides the primary evidence base for periodic review. Exportable in JSON and PDF.
• Back-up. Neon PostgreSQL provides automated continuous backup with point-in-time recovery. Backup frequency and retention period are detailed in the Neon sub-processor entry below.
• Batch processing and data integrity. Output generation is deterministic. The same canonical input always produces the same output. Each generated output stores a SHA-256 content hash in generated_outputs, enabling re-verification at any time.

Data residency and storage

EU-only data residency is available as a deployment option. Contact security@veracore.io to request an EU-region tenant. This is not a roadmap item — it requires configuration of your specific deployment, not a product change.

Audit trail guarantees

• Append-only. The audit_events table has no UPDATE or DELETE grants for the application role. Every write is an INSERT. Once written, a row cannot be modified by any code path in the application.
• SHA-256 content hashing. Every create, update, approval, and output-generation event records the SHA-256 hash of the content at that moment. For SmPC sections, the hash covers the exact section text. For generated outputs, the hash covers the full output document. Re-running generation from the same canonical input produces an identical hash — divergence indicates unauthorised modification.
• Time-stamped records. All audit events use created_at TIMESTAMPTZ DEFAULT NOW() at the database layer. Application-layer timestamps cannot override this.
• Actor attribution. Every event records the user ID of the actor. Bulk actions (e.g. batch publish) record each sub-event individually.
• Exportable in machine-readable format. Audit logs are available via the /api/audit endpoint in JSON. PDF export is on the roadmap. PDF export — roadmap
• Retention. Audit events are retained for the life of the tenant plus 10 years from account termination. Early deletion is not possible except through a court-ordered data erasure — which itself is logged.
• SmPC version history. smpc_section_versions stores every prior state of every section. This is separate from the audit log and provides full text reconstruction at any historical point.

Access controls and authentication

Role-based access model

The RBAC model is designed and the data model supports it. Role enforcement at the API layer is the next auth milestone. Current deployments operate as single-tenant with operator-controlled access.

Authentication

• SSO via SAML 2.0 / OIDC. On the roadmap. Priority for enterprise and consultancy tiers. Roadmap
• MFA enforcement. On the roadmap, will be mandatory for Approver and Publisher roles. Roadmap
• Session management. Current sessions are stateless JWT-equivalent. Session revocation on role change or termination is part of the auth milestone.
• Password policy. Enforced minimum entropy, bcrypt hashing at storage. No plaintext credential storage at any layer.

Network security

• All traffic over HTTPS/TLS 1.2+. HTTP requests are redirected to HTTPS.
• Database connections use TLS. The connection string is held in environment variables — not in source code or build artifacts.
• No inbound ports exposed other than HTTPS (443) and the Render health-check endpoint.

Validation support (IQ / OQ / PQ)

Veracore is designed to be validatable. The following documentation is available to customers for their own validation packages:

To request validation documentation, contact security@veracore.io with your company name and the tier you are evaluating. Typical turnaround is 2 business days.

Sub-processors and infrastructure

Veracore does not use third-party analytics SaaS beyond a first-party Polsia analytics beacon (no personal data — anonymous visitor ID only). No product information data is transmitted to any analytics service.

This list is maintained and updated when sub-processors are added or removed. Customers on enterprise agreements will receive 30 days' notice of material sub-processor changes.

Honest status: GA vs. roadmap

The table below is a direct summary. Items marked Roadmap are not available today. Do not rely on them in your current validation or purchasing decision without explicit written confirmation of delivery timeline.