An audit pack that is a filtered view, not a project
Scoped client access without a second system, change control routed by each client's agreement, and an audit pack that is a filtered view rather than a project. Validation-ready for ICH Q7, EudraLex Volume 4 Part II and Revised Schedule M, and kept current with regulatory change as part of the product, at no extra cost.
Your client is responsible for a batch you made
When a contract site runs a batch, the owner remains responsible for compliance with manufacturing practice and the contract facility is a manufacturer in its own right. Two parties, one batch, one record, and no regulation anywhere that assigns ownership of it. Everything difficult about running a contract site descends from that.
What the regulations do fix is that the executed record exists at the site that performed the manufacture, is readily available for inspection, and if electronic is immediately retrievable throughout its retention period. Everything else, retention, format, access rights and what happens when the contract ends, is settled by the quality agreement. Factro is built so the record of truth stays where the regulation puts it while your client still sees what their agreement entitles them to see.
The controls below run on the same compliance engine every industry uses.
What's tailored for api & cdmo
Not just compliance mapping — here's where the modules themselves work differently for this industry.
Change control routes per client, matching each agreement's own approval and notification thresholds instead of one blanket workflow.
Scoped client access — each client sees their batches, deviations, changes and documents, and nothing belonging to another.
Cleaning validation and cross-contamination control, including containment tracking for potent materials.
20 controls, 6 standards
Select a standard to filter
Working draft, not a certified mapping — our own reading of each framework's published scope, not a legal determination.
Coverage by geography
We watch the regulations so you don't have to
Standards don't stay still. The Compliance Engine tracks every one that applies to you: when a rule changes, it tells you what it affects, updates the system, and re-validates before anything goes live. You don't file a change request. It's already handled.
Scoped multi-client access shipped
Client-specific change control routing and scoped access — each client sees only their own batches and documents — were built before Schedule M's API-site enforcement went live with no grace period.
Revised Schedule M enforcement for API sites
Where ICH Q7 recommends, Schedule M requires — pharmaceutical quality system, quality risk management, product quality review, lifecycle validation, computerised system controls and data integrity are now obligations on every covered site, with no grace period for any turnover band.
Every update runs through the same validation discipline as the platform itself — tested against the workflows it touches before it reaches a single client's floor. Nothing ships because a regulation changed; it ships because the change passed.
Schedule M turned should into shall
India's revised Schedule M covers active pharmaceutical ingredients in a part structured to mirror ICH Q7 section by section, with one difference that runs through the whole text. Where ICH Q7 recommends, Schedule M requires. Pharmaceutical quality system, quality risk management, product quality review, lifecycle validation, computerised system controls and data integrity are obligations on every covered site, including API sites, and enforcement is live with no grace period for any turnover band.
Audit readiness as a state, not a project
A contract site is audited by its clients continuously, and every audit walks the same ground.
Validation readiness
The controls above are enforced in the architecture, not configured on top of it.
- Validation packs (URS, IQ, OQ, PQ, RTM, GAMP 5) are available on the Dedicated tier.
- ISO 27001 certification is in progress.
- Inspection readiness is scored continuously by the Compliance Engine, not assembled the week before an audit.
For the technical detail behind these controls — encryption, access control, audit trail mechanics and backups — see Infrastructure & Security. For what sits in each workspace, see Modules.
Have a compliance requirement to walk through?
Tell us about your regulatory environment and we'll show you exactly how Factro fits.