Foundation

Security & trust

Data sits on a shared platform in a country nobody chose. An update arrives whenever the vendor ships it.

Data sits on a shared platform in a country nobody chose. An update arrives whenever the vendor ships it. Phasis runs on a European cloud provider, or on a server at your site, on hardware set aside for you alone. It is never shared with another customer. An update reaches your system only when you choose to install it, at a time you agree with us.

A wrong entry is edited and the old value is gone. Phasis never deletes a regulated record. Approved records lock. Corrections are new records that point at the original. OEE and safety rates are computed by the server: a missing input leaves a blank, never a zero that reads as good news.

Who uses it

IT manager
Chooses European cloud or on site, and agrees when an update may land.
Quality manager
Shows an auditor the named way a record is withdrawn, and that an approved file cannot be swapped.
Validation lead
Maps the integrity rules into the validated system and the procedures around it.
Plant manager
Knows where the data sits and that an update will not arrive in the middle of a shift.

Today vs Phasis

Today

With Phasis

TodayA wrong entry is edited and the old value is gone.
With PhasisA wrong entry is voided with a reason, and the original stays where the auditor can see it.
TodayAn approved certificate can still be opened and changed.
With PhasisAfter approval the record locks, and a correction is a new record that points at it.
TodayOEE and safety rates are typed into a report.
With PhasisThe server computes them. A missing input leaves a blank, never a fake zero.
TodayData sits on a shared platform in a country nobody chose.
With PhasisOn a European cloud, or on site, on hardware set aside for you alone.
TodayAn update arrives whenever the vendor ships it.
With PhasisAn update lands at a time you agree, so production is not interrupted.

The data integrity rules

Seven rules that apply in every module. An auditor recognizes them at once.

1
No hard deletes

A regulated record is never removed. Every type has a named way out: an NCR is canceled, a certification is revoked with a reason, a reading is voided with the original left in place.
2
Approved records lock

After approval, a calibration, a certificate or a qualification file cannot be edited.
3
Corrections are new records

Nothing is overwritten. The correction sits beside the original and points at it.
4
The server computes

Calibration errors, cleaning limits, chart limits, OEE and safety rates are calculated, not typed. A typed number is an audit risk.
5
Names are frozen

The name is stored at the time of the action. A person leaves and the record still names them.
6
Two people, where it matters

The system refuses self-approval, even when one user holds both roles. Quality, Calibration, HSE, Permit to Work and Documents all enforce it.
7
Rates never lie

Missing hours means a blank safety rate, never a fake zero. Missing cycle time means a blank OEE, never a fake zero.

Where compliance comes from

FDA 21 CFR Part 11 is the US rule for electronic records and signatures in regulated plants. EU GMP (good manufacturing practice) Annex 11 is its European counterpart. Both ask the software for the same three things, and the platform has them. The signature, the audit trail and the permission check are built and working.

Compliance itself is wider than the software. It is the plant's validated system, the plant's procedures, and what the plant files with the regulator. That is where a Part 11 or Annex 11 position is held, and it is held by the plant. We supply the software part, and we support the validation around it with the evidence a validation lead needs.

One thing to plan for when the roles are drawn up: access is granted per module, not per record and not per line. Someone with write on Quality can act on any NCR, not only the ones they raised.

How an update reaches your plant is described on the How we work page.

What you get

Seven data integrity rules that hold in every module.
Regulated records withdrawn by a named route, never deleted.
Approved records that lock, with corrections kept beside the original.
Rates and errors the server computes, so an audit-critical number is never typed.
Hosting on a European cloud or on site, on hardware set aside for you.
Updates on a day you pick, not on the vendor's ship date.