Security & trust
Who did what, and where it sits.
A plant system is trusted for two reasons: the record survives an audit, and the data stays where the plant expects it. Both are platform rules rather than per-module features.
Login, SSO and MFA
People sign in with the company account. We do not store passwords.
Authentication is handled by Keycloak, an identity product used widely in enterprises. We did not write it. Your identity provider, your single sign-on (SSO), your multi-factor authentication (MFA), your password rules, your session length and your lockout policy stay yours.
Tokens are checked on every request, not only at the login screen. The browser keeps the token in memory rather than in a stored cookie a second tab can loot. IT disables a leaver in one place and access to every module stops.
Roles and permissions
Read, write or approve, per module. The server enforces it, not the screen.
A user gets a role. The role carries a level on each module: read, write or approve. Approve is the strongest and covers the decisions, such as approving a calibration, releasing a work order or closing an NCR (non-conformance report).
Three gates stack. Is the module licensed, or is it absent. Does the user hold the level this action needs, checked on the server. And even with the level, nobody approves their own work, including when one person holds both roles.
Audit trail
The database records every insert, change and deletion, and every regulated record names who did what and when.
There are two layers, and they are different things. On the record: an NCR keeps the reporter, the investigator and the approver, each with a name and a time. The name is a snapshot, so the record still says who did the work long after that person has left.
Under the record: the database itself writes every insert, change and deletion, with who, when and which fields. A module cannot forget to log. Nothing in that log can be edited or deleted.
Electronic signature
Off by default. A plant switches it on per action, and the approver types their password at the moment they approve.
It is a real password check against your login system. The platform records the name, the date, the time and the meaning of the signature, tied to the exact state of the record. Edit that record later and the old signature does not silently carry over.
This is what FDA 21 CFR Part 11 and EU GMP (good manufacturing practice) Annex 11 ask the software to do. A plant with no such obligation runs with signatures off and never sees a signing dialog.
Where it runs
On site, or on a European cloud, on hardware set aside for the customer.
Phasis runs on a server at your site, or with a European cloud provider on hardware reserved for you alone. It is never shared with another customer. Data can stay on site, which settles the question for pharmaceutical, defense and any strict data policy.
On site, the plant keeps running when the internet drops. Shop-floor screens do not wait for a round trip to another country. The design assumption is around 30 people using the system at once, per plant.
Who can reach it
Every screen action is an API call. There is no second, hidden channel.
Integrators get one description file of every endpoint and every field, generated from the code, and the portal itself is built from that file. Traffic is ordinary HTTPS and JSON. Machines send counts and meter readings over MQTT, the common shop-floor messaging protocol.
A module that is switched off has no screens and no API. It is absent, not forbidden. Whatever reaches the API, including an AI assistant pointed at it, is subject to the same licensing and the same permission check as a person.
The data integrity rules
Seven rules that apply in every module. An auditor recognizes them at once.
- 1
No hard deletes
A regulated record is never removed. Every type has a named way out: an NCR is canceled, a certification is revoked with a reason, a reading is voided with the original left in place.
- 2
Approved records lock
After approval, a calibration, a certificate or a qualification file cannot be edited.
- 3
Corrections are new records
Nothing is overwritten. The correction sits beside the original and points at it.
- 4
The server computes
Calibration errors, cleaning limits, chart limits, OEE (overall equipment effectiveness) and safety rates are calculated, not typed. A typed number is an audit risk.
- 5
Names are frozen
The name is stored at the time of the action. A person leaves and the record still names them.
- 6
Two people, where it matters
The system refuses self-approval, even when one user holds both roles. Quality, Calibration, HSE (health, safety and environment), Permit to Work and Documents all enforce it.
- 7
Rates never lie
Missing hours means a blank safety rate, never a fake zero. Missing cycle time means a blank OEE, never a fake zero.
How an update reaches your plant
A change starts as a request and ends on your server. These are the steps that matter to the people who have to sign for it.
- 01
A second person checks every change
The reviewer did not write the change. They read it and look for mistakes before it moves forward.
- 02
Login and data protection get a security check
Anything that touches login, user roles or how data is protected gets an extra security review. A change that touches a standard your industry follows is checked against that standard.
- 03
It is tested on a copy, with sample data
Automatic checks run on every change. A full test then runs on a copy of the system with sample data, the way a real user would use it. A release-wide test runs before anything ships.
- 04
You choose when it installs
An update reaches your system only when you decide to install it. We agree the time with you, so an update never interrupts production.
- 05
The record stays
We keep a record of every change that ever reached your system. If your plant follows a quality or compliance standard, that record supports your own audits.
The full process, from request to support, is on How we work.
What we do not claim
The honest limits. You will hear the same answers from us on a call.
- We do not claim Part 11 compliance from the software alone. No software is compliant on its own. Compliance is your validated system, your procedures and what you file with the regulator. The part we own, the signature, the audit trail and the permission check, is built and working, and we support the validation around it.
- We do not offer record-level or line-level permissions. Access is granted per module. Someone with write on Quality can act on any NCR, not only the ones they raised.
- We do not escalate alerts. Nothing tells a manager because the first person never looked, and there is no quiet-hours setting and no digest mail.
See it on your own plant.
Thirty minutes with an engineer. We walk the modules you care about against your own lines and shifts.