Data Processing & Compliance
What manufacturing data we process, what we do not store, and how we align with ISO 9001, ISO 14001, OSHA, FDA cGMP, and FDA 21 CFR Part 11 requirements.
Data Scope
Data We Process
- ✓Check definitions — Check IDs, categories (dimensional/surface/material), severity levels, SPC control limits, compliance framework tags
- ✓Inspection results — Pass/fail outcomes, measured values, execution times, false rejection flags
- ✓Part identifiers — Your internal part numbers and lot IDs (opaque strings). We use these to track inspection history across sessions.
- ✓Operator identifiers — Opaque operator IDs for competency tracking. No personal information (names, employee numbers) is required.
- ✓Session metadata — Timestamps, inspection duration, framework selection, line identifiers
Data We Do Not Process
- ✗Proprietary product data — We never receive or store CAD files, engineering drawings, material specifications, or manufacturing process parameters
- ✗Trade secrets — No formulations, recipes, process recipes, or proprietary tooling information
- ✗Customer information — No end-customer data, order details, or supply chain relationship information
- ✗Employee PII — No names, employee numbers, photographs, or biometric data. Operator IDs are opaque strings you control.
- ✗Facility details — No floor plans, equipment inventories, production capacities, or site-specific safety records
ISO 9001 Alignment
Quality Management System
QLM supports your ISO 9001:2015 compliance by providing auditable, data-driven quality assessment records:
- ✓Clause 8.6 — Release of Products and Services — Every optimized inspection produces a complete audit trail: which checks were selected, why, what results were obtained, and the resulting quality confidence level. This documentation supports your release decision process.
- ✓Clause 7.1.5 — Monitoring and Measuring Resources — The engine tracks measurement tool assignments and supports gage R&R data integration. SPC control limits are maintained per check for continuous process monitoring.
- ✓Clause 7.2 — Competence — Operator competency certification sessions produce auditable records including competency scores by domain, scenario responses, and pass/fail determinations.
- ✓Clause 9.1 — Monitoring, Measurement, Analysis and Evaluation — All inspection data and quality trends are available via API for integration with your quality dashboards and management review processes.
ISO 14001 Alignment
Environmental Management System
QLM supports ISO 14001:2015 environmental compliance through safety monitoring integration:
- ✓Clause 6.1.2 — Environmental Aspects — Safety monitoring checks can include environmental hazard categories (chemical exposure, waste handling, emissions). The engine prioritizes environmental checks based on current production conditions.
- ✓Clause 8.1 — Operational Planning and Control — Environmental monitoring schedules are maintained and optimized while ensuring 100% coverage of required monitoring points.
- ✓Clause 9.1.2 — Evaluation of Compliance — Complete audit trails for environmental monitoring checks support your compliance evaluation process.
OSHA Compliance
Occupational Safety and Health
QLM's safety monitoring module supports OSHA general industry standards (29 CFR 1910):
- ✓Hazard identification — Safety checks cover mechanical, chemical, ergonomic, and electrical hazard categories. The engine ensures all OSHA-required inspection categories are covered within each monitoring period.
- ✓Lockout/Tagout (1910.147) — Lockout/tagout verification checks are supported as a first-class check category with escalation triggers when violations are detected.
- ✓Machine Guarding (1910.212) — Guard integrity checks are maintained with increased priority during shift changes and after maintenance activities.
- ✓Recordkeeping (1904) — All safety check results are retained with full audit trails, supporting your OSHA 300 log documentation requirements.
FDA cGMP & 21 CFR Part 11
FDA Compliance for Regulated Manufacturers
For manufacturers in FDA-regulated industries (medical devices, pharmaceuticals, food), QLM supports cGMP and 21 CFR Part 11 electronic records requirements:
- ✓Electronic Records (Part 11.10) — All inspection records are stored with integrity controls: timestamps, operator identification, and tamper-evident audit trails. Records cannot be modified after creation.
- ✓Electronic Signatures (Part 11.50) — The API supports operator authentication tokens that serve as electronic signatures on inspection results. Each result is linked to an authenticated operator identity.
- ✓Audit Trails (Part 11.10(e)) — Computer-generated, time-stamped audit trails independently record the date and time of operator actions. Audit trails are maintained for the required retention period and are available via API.
- ✓Compliance Mode — When operating under FDA regulation, the engine's compliance mode ensures all cGMP-required checks are performed on every unit, while optimizing the selection and order of supplementary checks.
- ✓Validation Support — QLM provides IQ/OQ/PQ documentation templates and supports validation protocols for your computer system validation (CSV) process.
Safety Data Handling
How Safety Records Are Protected
Safety inspection data receives additional protections given its regulatory sensitivity:
- ✓Immutable records — Safety check results cannot be modified or deleted via API. Failed safety checks remain in the audit trail permanently.
- ✓Escalation logging — When a safety check failure triggers an escalation, the entire escalation chain (detection, notification, resolution) is recorded with timestamps.
- ✓Retention — Safety records are retained for a minimum of 5 years, exceeding OSHA's 5-year recordkeeping requirement (29 CFR 1904.33).
- ✓Export — All safety records are exportable in structured formats (JSON, CSV) for integration with your EHS management system.
Security Architecture
HTTP requests are rejected, not redirected. All data in transit is encrypted.
Keys are scoped to your organization. Separate sandbox and production keys. Keys are rotatable without downtime.
Your data is logically isolated at the database level. No cross-customer data access is possible.
All stored data is encrypted at rest using AES-256. Encryption keys are managed through a dedicated key management service.
Internal access requires explicit justification, is logged, and is reviewed quarterly. No standing access.
Affected customers are notified within 72 hours with a full incident report and remediation plan.
Need Our DPA or Security Questionnaire?
Contact us for a data processing agreement, completed security questionnaire, or architecture review with your quality and compliance teams.
Request Sandbox Access