Ledger is the record a sterile-production facility runs on: every batch, every check, every signature, written down as the work happens. Because the governing regulation is recorded beside each action, the production history is inspection-ready as a byproduct of the work, not a reconstruction after it. The whole operation lives in one database: formula, batch, personnel, equipment, environmental monitoring, warehouse, distribution, and documents. A question about any of them is answered by query against one record, and the assistant reads all of it. It is built for FDA-regulated production under current Good Manufacturing Practice (compounding facilities, 503B outsourcing facilities, and contract manufacturers) and implements 21 CFR Part 11 natively from the first commit: Master Formula Studio, the electronic batch record and its six-phase gate, environmental monitoring bound to the compounding session, a SHA-256 hash-chained audit trail, and multi-signature release. The software supports the licensed operators; it does not replace a required signature.
ABOUT THIS ENGAGEMENT Regaldi is the software vendor for the facility's system of record. As of this writing the facility is built and awaiting commercial activation; it has not yet produced commercial batches and has no production or inspection history. The capabilities below are functions of the software, which operates on data and configuration supplied by the facility. The software supports the facility's regulatory, quality, sterility, and Board of Pharmacy obligations; it does not replace, perform, or guarantee them. Those obligations remain the facility's responsibility under the supervision of its licensed personnel. Computerized-system validation under GAMP 5 is software validation, not FDA approval, clearance, or inspection.
On a gated path, a step out of order is not a low-probability event the SOP discourages. The interface does not offer it, and the database refuses it; the phase gate will not advance until the required checks are on the record. The class of error in which a step is skipped is removed by construction, not policed by training.
Every action is written with the operator, the server timestamp, the Master Formulation Record version, and the environmental-monitoring sample bound to that session. The record an investigator asks for already exists, assembled by the work itself, not by a week of preparation before the visit.
Thirty-six sections of 21 CFR Part 211 and ten USP general chapters are cited beside the step each governs, not filed in a binder and surfaced once a quarter. The operator sees the provision where the decision happens.
From a component lot, the system resolves every batch that drew on it and every unit shipped; from a unit, the lots that fed it. The question resolves against the record, not against a reconstruction from paper.
A failed filter-integrity or in-process result opens a deviation against the record in the same database transaction, and the lot is held for disposition. Where USP <797> requires a second check, the system refuses a verification in which the performer and the verifier are the same person.
One sterile-compounding batch, followed through the running system of record: authored, staffed, run through its gates, tested, released, and recorded. The system does not ask people to remember the rules. It encodes them, gates on them, and proves them. Every screen below is the actual application, populated with representative demonstration data; the facility has not yet produced commercial batches, and the records shown are illustrative.
The regulatory provisions the workflow cites and enforces, counted from the codebase, not asserted.
The Master Formulation Record is authored visually in Formula Studio and approved under change control: components, in-process checks, and the step sequence, as reusable action blocks.
Every role that acts on a batch is qualified first, and the system blocks the work, not just warns, if a competency has lapsed.
Fourteen roles and sixty-nine permissions, least-privilege by default. The access layer also enforces a separation-of-duties matrix, so a role cannot be granted a combination that breaks compliance.
Each instrument and engineering control is qualified (DQ/IQ/OQ/PQ) and calibrated; the system gates compounding on both being current.
The electronic batch record advances through a six-phase gate. Each phase demands its evidence, and the database itself refuses to skip one.
Every batch pulls a release sample and runs the compendial panel; samples and results are bound to the batch record.
Release runs a checklist and three distinct signatures, and the system will not let one person hold two of the roles.
The audit trail records who did what and when, with each entry cryptographically chained to the one before it.
A change of state in the process creates and assigns the next task (QC testing, QA review, a release authorization) to the right role, automatically.
Every material lot flows through named zones (receiving, quarantine, sampling, released, staging, disposition) with live counts, so nothing is dispensed before it is released.
Every material lot is tracked by zone and bound into the batches that drew on it, so a recall is answered by query, not by paper.
The worked example below is a 503B sterile-compounding outsourcing facility. Ahead of its launch, Regaldi delivered the system of record it is built to operate under: seventy-seven modules organized into eight bounded contexts: Compounding, Quality, Personnel, Equipment, Environmental Monitoring, Warehouse, Distribution, and Documents. The structure is designed to support the facility's obligations under current Good Manufacturing Practice and the compounding provisions of Section 503B of the Federal Food, Drug, and Cosmetic Act. The system is complete, with a GAMP 5 Category 5 validation package authored against it; execution of that package precedes commercial activation. The facility is built and awaiting that activation.
Compounding begins with the Master Formulation Record. Master Formula Studio is the visual environment in which a formulation is authored and versioned under change control: components, quantities, in-process checks, and step sequence. Each Master Formulation Record carries a version identity that every downstream compounding record is bound to, so a compounding record can always be read against the exact MFR revision under which it was executed.
Batch Cockpit is the electronic batch-record surface for a compounding record. The record advances through a six-phase state machine designed to block phase advancement until the requirements the facility configures are satisfied of record: environmental-monitoring verification and equipment qualification before the session opens, garbing and line-clearance confirmation at entry, filter-integrity and container-closure checks at fill, and the in-process checks each gate prescribes. The gates are enforced by the system rather than left to manual reminder; any exception is routed through the facility's documented deviation procedure and written to the record.
Environmental monitoring is bound in the system of record to the compounding session it covers. The viable and non-viable air samples, the surface samples, and the personnel fingertip samples are recorded against the specific compounding record, not filed separately, so the conditions under which a given lot was compounded are available for review as part of that lot's record, in keeping with USP General Chapters <797> and <800>.
Every action in the system is written to a tamper-evident audit trail in which each entry is cryptographically chained to the one before it by SHA-256 hash, so that any alteration or removal breaks the chain and is detectable on a walk-and-verify. Electronic signatures carry the signer's printed name, the date and time, and the meaning of the signature, consistent with 21 CFR Part 11 sections 11.50 and 11.70, and each signature is bound to a hash of the record's content at signing time. Each signature is executed with two distinct identification components in accordance with 21 CFR 11.200(a), re-authenticated at signing; multi-factor authentication governs system access, and the signing layer is designed to prevent one operator from signing as another.
No compounding record releases on one signature. Release requires the quality-control approval, the quality-assurance review, and the Pharmacist-in-Charge authorization, each captured as a distinct electronic signature, re-authenticated at the moment of signing, with the originating IP address and user-agent recorded. The PIC release authority remains with the licensed pharmacist; the software gates the sequence and records it, and does not sign on anyone's behalf.
Traceability runs in both directions. From an incoming component lot, the system resolves every compounding record that drew on it and every unit shipped; from a finished unit, it resolves the Master Formulation Record version, the compounding record, the environmental-monitoring samples bound to the session, the personnel who executed each step, and the component lots that fed it. When a recall question arises, the system is built to answer it by query rather than by reconstructing paper, resolving the affected lots and the recipients each shipped to, in keeping with the lot-level batch and distribution records cGMP requires.
Quality events are handled within the same record, not in a separate binder. When a result falls out of specification, the compounding record is held from advancing; the system opens an out-of-specification (OOS) investigation through its phased sequence, links the deviation and any resulting corrective and preventive action (CAPA) to the record, and holds the lot in quarantine until disposition. Change control governs revisions to a Master Formulation Record, and the annual product review draws on the records already bound to each lot.
As a custom-developed application, it follows a GAMP 5 Category 5 approach: computerized-system validation spanning design, installation, operational, and performance qualification, each traceable to a documented user requirement. The validation package is authored; its execution precedes commercial activation. Computerized-system validation is software validation, not FDA approval, clearance, or inspection.
No. Release requires distinct electronic signatures from quality control, quality assurance, and the Pharmacist-in-Charge, each executed with two distinct identification components in accordance with 21 CFR 11.200(a) and recorded under sections 11.50 and 11.70, with segregation of duties enforced in the release sequence. The first signing in a continuous session uses all components; each subsequent signing uses at least one component unique to the signer.
Each audit entry is cryptographically chained to its predecessor by SHA-256 hash, so any retroactive alteration breaks the chain and is detectable on a walk-and-verify. This is tamper-evident, not tamper-proof: the chain makes a change detectable rather than preventing the underlying write.
No. The SCADA and equipment-interface layer is a vendor-neutral architecture; Siemens process equipment is the currently deployed instance. Environmental and equipment data are bound to the compounding record through an integration layer rather than a single proprietary dependency.
Each facility runs on dedicated, isolated infrastructure rather than a shared multi-tenant pool, and the deployment region is chosen so the facility controls where its data physically resides. Hosting is provisioned per engagement under the written engagement letter.
Yes. The architecture separates the core from facility-specific configuration (master formulation records, equipment registers, monitoring plans), so a second outsourcing facility can be provisioned under written engagement letter, subject to that facility’s own validation and qualification.
Under a written engagement letter with a defined scope and deliverables. Each engagement opens with a process and compliance audit, delivered as a written architecture and remediation plan; the build that follows is scoped and priced from that plan. Terms are stated in the letter before work begins.
If a sterile-compounding or manufacturing facility is being stood up or re-validated, Regaldi will walk the VP of Quality and the Pharmacist-in-Charge through how this system of record enforces release gates, electronic signatures, environmental-monitoring binding, and lot traceability. The core is deployable at additional sterile-production facilities under written engagement letter, configured and validated for each facility's own scope. To request a technical review, write to the principal at office@regaldi.ai.