Spatial CMMS for Pharmaceutical Manufacturing — GMP Plants
MYREX is a Spatial CMMS for pharmaceutical manufacturing, built around a high-definition 3D capture of each machine. Work is recorded with an attestation by an identified user and written to an audit trail secured by a SHA-256 hash chain, and the evidence attached to that record — photos, video, notes — is pinned to the exact spot on the equipment it was taken at. The necessary distinction, first rather than last. No vendor can sell you a validated system. Validation is something you perform in your own environment, against your own intended use. What a vendor can honestly offer is a product designed in alignment with the relevant requirements and the willingness to support your validation with real detail. That is what this page describes.
Why is a maintenance record a regulated record?
Because 21 CFR 211.182 says so, and it says more than most maintenance software acknowledges. The section requires a written record of major equipment cleaning, maintenance and use — carving out only “routine maintenance such as lubrication and adjustments” — with entries in chronological order. Where equipment is dedicated to one product and lots follow in numerical order and sequence, the regulation is explicit that the records of cleaning, maintenance and use “shall be part of the batch record.” On a dedicated filling line, the equipment cleaning and maintenance log is part of the regulated record — not adjacent to it, not supporting it. That is why we treat MYREX as a direct impact system and scope from there, rather than arguing for a lower tier and hoping nobody checks. It is also actively inspected: FDA warning letters cite 211.182 by number for failures to keep appropriate written records of major equipment cleaning, maintenance and use.
21 CFR 211.67
A maintenance and cleaning program — written procedures, assigned responsibility, schedules — with records kept under 211.180 and 211.182
21 CFR 211.182
The execution of that program is logged: chronological, dated, signed, with the date, time, product and lot of each batch processed
21 CFR 211.180
Those records are retained for the batch retention period and kept readily available for inspection
What does a GMP plant need from maintenance software?
Three things beyond the ordinary maintenance job. Work has to be attributable to an identified individual. The record has to be protected from undetected alteration and retrievable for as long as it is required. And preventive maintenance (PM) that was performed outside its window has to be visible as such, rather than quietly absorbed. MYREX addresses those directly: identity through Microsoft Entra, so the name in the record is your own directory identity; attestation on completed work; an audit trail secured by a SHA-256 hash chain, where each entry incorporates a hash of the one before it, so alteration is detectable rather than prevented — which is precisely what tamper-evident means; and a manager dashboard showing open, overdue, due-today and unassigned counts with due dates. Data integrity vocabulary, used precisely: the attributes GMP-side guidance uses are ALCOA+ — attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring, available. That is the list in PIC/S PI 041-1 and WHO TRS 1033 Annex 4, the in-force GMP guidance. ALCOA++ adds traceable. It appears in EMA’s 2023 guideline on computerised systems and electronic data in clinical trials, and in the July 2025 consultation draft of the revised EU GMP Chapter 4, which has not been adopted.
Where does MYREX stop? The double-check
21 CFR 211.182 requires that the persons performing and double-checking equipment cleaning and maintenance each date and sign or initial the log. MYREX does not do the double-check today. There is no countersignature, no reviewer signing, no second-person verification of any kind. On equipment where your procedure requires one, MYREX does not satisfy that requirement on its own. We put that on the industry page rather than burying it, because a page that cites 211.182 and stays quiet about the double-check is making a claim by omission.
How does MYREX relate to equipment qualification?
Carefully, and it is worth being exact, because two different things are routinely called the same word in this industry. Equipment qualification — installation qualification, operational qualification and performance qualification (IQ/OQ/PQ) — is the documented exercise of demonstrating that a piece of process equipment is installed as specified, operates as intended across its range, and performs consistently in routine use. It is about the filler, the tablet press, the lyophiliser. Computer software validation is a separate exercise, applied to a computerised system used in a regulated process, and it is performed by you in your environment for your intended use. MYREX does not perform either one, and does not claim to. What it does is hold the maintenance record that qualification depends on afterwards: a qualified machine stays qualified only while it is maintained as specified, and the evidence for that is the maintenance history.
Which regulations apply, and what is their current status?
21 CFR Part 11
In force. FDA’s Scope and Application guidance, September 2003, is still the operative guidance for GMP manufacturing.
21 CFR 211.67 / 211.180 / 211.182
In force. The predicate rules that make a maintenance record a regulated record.
EU GMP Annex 11
The January 2011 revision is the in-force text, operative since 30 June 2011.
Revised Annex 11, revised Chapter 4, new Annex 22 (AI)
Draft. Consulted 7 July – 7 October 2025. Consultation closed; not adopted; no published adoption date.
ISPE GAMP 5, 2nd Edition (July 2022)
Industry guidance, not regulation. It supplies the risk-based approach; it does not bind you.
PIC/S PI 041-1
In force since 1 July 2021. The ALCOA+ source on the GMP side.
We will not describe draft Annex 22 as a requirement. And we will not cite FDA’s Computer Software Assurance guidance in a pharmaceutical context — it is scoped to medical device production under 21 CFR Part 820, not pharmaceutical manufacturing under Parts 210 and 211.
What does the location on the record add in a GMP context?
The machine that was never modeled. Most spatial software starts from designed geometry — a CAD model or a building model that somebody drew. The equipment costing a GMP plant the most is typically twenty years old, modified twice on site, and was never drawn at all. Our geometry is captured reality rather than design intent, which is why a machine with no model is the normal case for us rather than the exception. On certifications and validation, which are not the same thing: the larger systems in this category lead with SOC 2 and ISO 27001 and publish no position on validation at all. We hold neither, and we say so — those certifications describe how a vendor runs its own information security program, and say nothing about whether a system produces records that satisfy 211.182, or about what a supplier will give you for your validation.
What actually ships today?
High-definition 3D capture of each machine
Shipped
Photos, video and notes pinned to exact locations on the machine
Shipped
Abnormality tags raised on the 3D scene, carrying the exact location
Shipped
Step-by-step guided mode
Shipped
Work orders — create, assign, complete
Shipped
Preventive maintenance (PM) calendar with recurring events linked to locations on the machine
Shipped
Asset pages with full activity history
Shipped
Report-a-problem escalation
Shipped
Media library
Shipped
Search across assets, marks (pinned locations on the machine), media, procedures, procedure steps and activity
Shipped
Manager dashboard — open, overdue, due-today and unassigned counts, with due dates
Shipped
Audit log, secured by a SHA-256 hash chain
Shipped
Attestation on completed work
Shipped
Microsoft Entra sign-in
Shipped
Per-step location anchoring of procedures
In development
Spanish (LatAm)
In development
Ask us rather than assuming. Second-person verification and countersignature are not in the product. There is no retention capability in the product today. The audit screen filters by action, entity type, date range and free text — it does not filter by asset or location; the full record is available through a complete, re-verifiable export. We hold no SOC 2 of either type, no ISO 27001, and we have had no third-party penetration test.
Frequently asked
Can a vendor claim 21 CFR Part 11 compliance for MYREX?
No product can be. Part 11 compliance is achieved by a regulated company through its own procedures, validation and operation of a system. MYREX is designed in alignment with 21 CFR Part 11 and EU GMP Annex 11 — attributable identity through Microsoft Entra, attestation on completed work, and a tamper-evident audit trail secured by a SHA-256 hash chain.
Is MYREX validated?
No vendor can sell you a validated system; validation is something you perform in your own environment. We will support your validation and we will not claim to have done it for you.
Does MYREX support the double-check that 211.182 requires?
No. There is no second-person verification, countersignature or reviewer signing in the product today. Where your procedure requires a double-check, MYREX does not satisfy that requirement on its own. We state it here rather than waiting to be asked.
Does MYREX do IQ/OQ/PQ for our equipment?
No. Equipment qualification is an exercise you perform on the process equipment itself. MYREX holds the maintenance record that keeps qualified equipment in its qualified state.
Does MYREX have electronic signatures?
MYREX records an attestation by an identified user on completed work. There is no re-authentication at the moment of attesting, so the record carries the identity on the authenticated session rather than proof of identity at signing. Whether an attestation meets your requirement for a signing under a given predicate rule is a determination you make in your validation.
What does “tamper-evident” mean here?
Each audit entry incorporates a cryptographic hash of the previous entry, so altering or removing an entry breaks the chain from that point forward. Changes are detectable, not prevented — protection today is application convention plus detection rather than database-level enforcement, and we use the accurate word rather than the reassuring one.
Is the revised Annex 11 in force?
No. The in-force text is the January 2011 revision. The revised Annex 11, the revised Chapter 4 and the new Annex 22 on artificial intelligence were consulted between 7 July and 7 October 2025 and have not been adopted, with no published adoption date.
Does MYREX handle calibration records?
No, and we carve it out deliberately rather than widening a scope line. Calibration records are product-decision data with a retroactive product-impact trigger; maintenance completion records are, in the base case, evidence of process compliance. Different risk classes.
See it on your own line.
Bring a machine you already know is a mess to explain, and we will show you what it looks like inside MYREX.