Our moat
Pure pharma is not our niche. It is the whole design brief.
Horizontal tools lose in pharma for one reason: they cannot survive a data-integrity inspection, and that cannot be retrofitted. So we start there.
The load-bearing idea
A signature in this system attests to specific content, by a specific verified person, and any subsequent change is detectable.
Everything else follows from that sentence: content hashing, the append-only trail, reason codes, the refusal of bulk signing, and the insistence that the audit event and the business change commit together or not at all.
Principles
What changes when pharma is the only customer
Compliance lives in the data model
GMP area class on a location. GxP class frozen on a project at creation. Medical fitness as a condition of access. These are columns and constraints, not custom fields a consultant adds in month nine.
Refusals are features
Self-approval is refused. Over-release of a commitment is refused. A booking on a date the person was not an active resource is refused. We show the refusal screens in demos, because a control nobody has watched refuse is one nobody knows works.
History is never overwritten
Baselines are superseded, hours are reversed, job history is appended. “What was true on that date?” is a query, not an investigation.
Your infrastructure, your data
Both products are built for on-premise deployment with no managed-cloud dependency, strict tenant isolation, and a schema style kept portable across PostgreSQL, Oracle and SQL Server.
Configuration, not customisation
Stage templates, approval routes, reason codes, qualification rules, statutory rules and terminology are tenant configuration: versioned, effective-dated and audited.
Claims proved by execution
Controls are exercised by scripts that rebuild a database from migration history and drive the real service. Each guard is watched failing before it is trusted. In one measured run, about a million audit events verified in under a minute.
Data integrity
ALCOA+ as engineering requirements
The principles a data-integrity inspector works from, and how they show up as product behaviour.
- Attributable
- Every write carries a verified actor. Signatures require re-authentication.
- Legible
- Labels read as they were on the record's effective date, so a rename never rewrites history.
- Contemporaneous
- The audit event commits in the same transaction as the change, not afterwards.
- Original
- Records are versioned. A correction supersedes or reverses, and the original stays readable.
- Accurate
- Rates, approvals and rules are resolved as of the business date, not as of today.
- Complete, consistent, enduring, available
- Append-only history, retention and legal hold, and evidence exports for any date range.
On the plant floor
The same standard, applied to people
In Helix the inspection question is about a person: were they qualified, trained, gowned and medically fit for that area on that date? The answer is reconstructed from append-only history, and gaps are printed rather than omitted.
See the Helix compliance moat →A plain statement about compliance
Software alone does not make a regulated company compliant. Your SOPs, training, change control and validation master plan remain yours. What we provide is a system designed to the relevant controls, together with the validation evidence and documentation your quality and CSV teams need to qualify it in your environment.
Bring your QA and CSV leads to the demo.
We would rather be questioned by the people who will have to defend the system than sell around them.