Trust Center
QMSdesk™ security, stated control by control
Your security review deserves answers it can check. This page sets out QMSdesk security as it's built: how your data is isolated, how every record stays provably intact, and who can do what. Ask for the evidence behind any line, and we'll show you the record.
What QMSdesk security gives your review
01
Controls you can see
Every control on this page can be shown to you on a screen share, in the running product.
02
Ownership stated plainly
Where a control belongs to our hosting provider, we say so, in the same sentence.
03
Answers from evidence
We answer your questionnaire from evidence. If something isn't in place yet, we'll tell you.
Your data, isolated
Tenant isolation is enforced by row-level security in the database. Within your organization, access follows permissions and site scope: events, risks, changes and CAPAs are scoped by site, global search returns only what each person may see, and restricted documents stay hidden from anyone without restricted-view rights.
QMSdesk is hosted with a cloud infrastructure provider that holds a SOC 2 Type II attestation. That attestation is the provider's, not Akatalyst's.
Every record, provably intact
QMSdesk security starts with the record itself.
Hash-chained
Every audit-trail entry is SHA-256 hash-chained to the entry before it, so a modified or deleted record breaks the chain and the break is detectable.
Immutable in the database
Audit-log immutability is enforced at the database layer, not only in application code. The log is insert-only for every connection, including direct database access.
Verified every day
A daily job re-walks every chain and alerts administrators to a break, and you can run it on demand. A second daily check confirms every signature still resolves to its record.
Reviewed on a schedule
A periodic audit-trail review works from a risk-focused view of signatures, role changes, deletions and configuration changes, and is signed on completion.
Kept, never destroyed
Audit-trail entries capture ALCOA+ attributes. Records raised in error are cancelled with a signed reason, never deleted, and disposal is a soft archive after your retention floor.
Signatures that hold up
- Re-authentication at every signature, with multi-factor enforced at sign-in and at signature when you require it.
- A controlled vocabulary of signature meanings, so what a signature means is recorded, not inferred, including administrative actions such as role grants and deactivations.
- Signature authority is validated before a signature is accepted, and the signature and the record change it authorizes commit in one database transaction.
- Segregation of duties is checked as each signature is made. An author never approves their own document, a requester never approves their own change, and an implementer never verifies their own work.
Access you control
Sign-in controls
Multi-factor authentication tenant-wide or by role, password history, account lockout that doesn't reveal which accounts exist, single-use reset links, and inactivity and absolute session timeouts. Passwords are hashed with bcrypt.
One person, one account
User IDs are never reissued.
Permissions by key
Nine core roles, plus the roles your regulatory profiles add. Authorization checks a permission key, never the role name.
An Administrator who configures, not approves
The Administrator holds no quality approvals.
Emergency access that can't sign
Break-glass access is granted, logged, time-boxed and reviewed, and it can never sign.
Vendor support on your terms
Our support access is time-boxed to at most 7 days, visible to you, authorized by a second operator, and it can never sign. Full administrator access needs your consent.
Cover and review
Delegations for cover, time-bound segregation-of-duties waivers that the beneficiary can't approve, and periodic access reviews.
Inspectors, read-only
Inspection View gives an inspector or customer auditor a time-boxed, read-only account that can view and export, and every access is logged.
Single sign-on and integration
- SAML 2.0 single sign-on, with options for Okta, Microsoft Entra, Google Workspace and custom SAML, set up from an admin screen with diagnostics.
- A REST API for audits, changes, documents, events, risks, suppliers and training, with OAuth client credentials, API keys and OpenAPI documentation.
A validated core platform
QMSdesk's core platform is validated under a QA-approved Validation Summary Report. We'll walk you through the full record under a mutual NDA.
What QMSdesk is designed to support, and what we hold
- Designed to support 21 CFR Part 11
- Designed to support EU GMP Annex 11
- ALCOA+ data-integrity controls
- Built to support organizations working to ISO 13485:2016
- Hosted with a cloud provider that holds a SOC 2 Type II attestation
These describe what QMSdesk is designed and built to support. They are not certifications, and we don't present them as such. There is no certification scheme for 21 CFR Part 11, EU GMP Annex 11 or ALCOA+. The SOC 2 Type II attestation belongs to our cloud infrastructure provider, not to Akatalyst. We hold no ISO 13485:2016 certificate; QMSdesk is built to support organizations working to ISO 13485:2016, and we'll demonstrate those capabilities on request. Ask for the evidence behind any line above, and we'll show you the record.
Questions buyers ask
How is our data kept separate from other organizations?
Tenant isolation is enforced by row-level security in the database. Inside your organization, access follows permissions and site scope.
Is QMSdesk SOC 2 certified?
QMSdesk is hosted with a cloud infrastructure provider that holds a SOC 2 Type II attestation. That attestation is the provider's, not Akatalyst's.
Do you support single sign-on?
Yes. SAML 2.0 single sign-on works with Okta, Microsoft Entra, Google Workspace or a custom SAML identity provider, and multi-factor authentication can be enforced tenant-wide or by role.
Can our auditors or an inspector get access?
Yes, through Inspection View: a time-boxed, read-only account that can view and export records but can't create, edit or sign anything. Every access is logged.
Does QMSdesk use AI on our records?
No. QMSdesk puts no AI model in any regulated decision path, and your data isn't used to train machine-learning models.
How do we send a security questionnaire?
Email it to info@akatalyst.com. We answer from evidence, and where something isn't in place yet, we say so.
Send us your security questionnaire
Your QA, IT or procurement team has questions. Send them over, and we'll answer control by control. Or bring one workflow, and see the controls working.