Question 1

Is BioTrace compliant with 21 CFR Part 11?

Accepted Answer

Yes. Every record is captured in an append-only audit trail with before/after snapshots, user identity, IP address, and timestamp. Electronic signatures capture printed name, date/time, and the meaning of the signature (authored, reviewed, approved). User authentication, session management, and audit-trail review are all built in.

Question 2

Do I need to validate the system before using it?

Accepted Answer

BioTrace ships with a complete IQ/OQ package and a validation summary report. Customers operating under GxP typically perform a UAT round on their own configured tenant. Our team supplies the validation templates and the change-control evidence you'll need for your inspection.

Question 3

Which regulations and standards does it cover?

Accepted Answer

FDA (21 CFR Parts 11, 210/211, 820, 312, 50, 56), EMA EudraLex Volume 4 (GMP) and ICH-GCP (E6 R3), ISO 13485, ISO 9001, ISO 14971, and the general GxP family (GMP, GLP, GCP). Enterprise customers can map custom frameworks.

Question 4

What's the difference between Starter, Professional, and Enterprise?

Accepted Answer

Starter ($299/mo) covers core quality — deviations, CAPAs, regulations, and the dashboard for up to 3 users on 1 site. Professional ($799/mo) adds audits, controlled documents, training, manufacturing, clinical trials, ISO tracking, suppliers, submissions, and inspection readiness for up to 25 users on 3 sites. Enterprise adds SSO, REST API, ERP/EDC/LIMS integrations, dedicated CSM, HIPAA BAA, and unlimited scale.

Question 5

Can I import my existing SOPs, suppliers, and equipment?

Accepted Answer

Yes. CSV import is supported for documents, suppliers, equipment, training records, and historical deviations. Every imported record retains its original date and is stamped into the audit trail. For Enterprise customers, we offer a guided migration with our compliance specialists.

Question 6

How is my data protected?

Accepted Answer

All data is encrypted in transit (TLS 1.2+) and at rest (AES-256). The platform is SOC 2 Type II audited. Each tenant is logically isolated with row-level security. Enterprise customers can opt into a dedicated database instance, EU data residency, IP allowlisting, and a HIPAA Business Associate Agreement.