The controls an auditor expects.In writing.
Compliance determination stays with your quality organisation. This page lists the technical controls we operate and the documentation we supply for your assessment.
One tenant. One region. Yours.
Each customer runs in a single-tenant environment in the region you select. Your evidence, records, and configuration do not share a database with any other customer.
- Region is set at onboarding and does not change without your written approval.
- Test accounts on your GxP systems stay under your control. We do not store their credentials outside your tenant.
- Backup schedule and retention are documented in the security overview.
Fixed roles. No local passwords.
Sign-in is through your identity provider only. Each user has one role per system, and the auditor role can read everything and change nothing.
- SSO only. There are no local user names or passwords to manage.
- Roles are fixed per system. A user cannot approve their own script or defect.
- Every role change is an audit trail entry.
| Role | Can do | Cannot do |
|---|---|---|
| Admin | Configure systems, assign roles | Approve scripts or reports |
| Validator | Start runs, take over, log defects | Approve, sign, assign roles |
| QA approver | Approve risk levels, sign reports | Edit steps after approval |
| Auditorread only | View all records and evidence | Change anything |
Append only. Any later change is detectable.
Every action is an entry in an append-only audit trail. Each entry carries the hash of the entry before it. Evidence is captured at execution time and hash-anchored to the trail.
- Screenshots and system state are captured at the moment a step runs, not after.
- ALCOA+: attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring, available.
- You can verify the chain yourself from an exported evidence bundle.
9f3c…a71eprev 2b80…c4d114:31:58 UTCe07a…5b92prev 9f3c…a71e14:32:07 UTC41d6…f0a3prev e07a…5b9214:33:10 UTCc88e…2d47prev 41d6…f0a314:33:11 UTC7a19…e3c0prev e07a…5b92got 7a19…e3c0MismatchSigned, not just saved.
Each signature is bound to the identity of the signer, the action, the meaning of the signature, and the time. It cannot be copied to another record.
- Identity is verified by your SSO at the moment of signing.
- The signature meaning is shown to the signer and stored with the record.
- The signed record hash is written to the audit trail.
Identity verified by SSO
Hash 9f3c…a71e
Your evidence leaves with you.
Every run, record, and piece of evidence is exportable at any time in open formats. Nothing is locked to Merivane.
- The evidence bundle includes the hash chain, so it can be verified without our software.
- Exports are themselves audit trail entries.
- Retention after contract end is stated in the security overview.
Sub-processors
Third parties that process customer data on our behalf. The list is kept current and is part of the security overview.
| Provider | Purpose | Region |
|---|---|---|
| AWS | Cloud hosting | Per tenant |
| Okta | Identity and SSO federation | Per tenant |
| MailGun | Transactional email | EU |
Notice period before a new sub-processor is added:
Documentation for your assessment
Ask for these documents. They support your vendor assessment and your validation of Merivane as a tool.
The controls an auditor expects, built in from the start.
Compliance determination stays with your quality organisation. We supply the technical controls and the documentation to support your assessment.
Tamper-evident by design
Append-only, hash-chained entries. Any later change is detectable.
Attributable e-signatures
Each approval is bound to identity, action, meaning, and time.
Role-based, SSO only
Fixed roles per system, including a read-only auditor role.
ALCOA+ capture
Captured at execution time, verified against live system state, hash-anchored.
Questions from security reviews.
If your question is not here, ask us. We reply within one working day.
Where does our data live?
In a single-tenant environment in the region you choose at onboarding. It does not move without your written approval.
Who can see our evidence?
Only users in your tenant with a role on that system. Merivane staff have no standing access. Support access is granted by you, time-limited, and recorded in the audit trail.
How are manual takeover actions attributed?
The takeover is an audit trail entry with the person's SSO identity. Every step they perform is captured with the same time stamps and hashes as AI steps and labelled with their name in the report.
Can we export everything if we leave?
Yes. Reports, evidence bundles, and trace matrices are exportable at any time in open formats. The bundle includes the hash chain so you can verify it without our software.
See a full run on one of your systems.
Bring one approved requirement. We show you the chain end to end, on a system you already use, in under an hour.
Book a demo