SECURITY & COMPLIANCE
How MYREX handles identity, records and attestation
This page states what each one guarantees, and what it does not. Sign-in is through Microsoft Entra, so the identity on every record is your organization’s own directory identity. Maintenance records — procedures, work records and attestations, and changes to them — are written to an audit log secured by a SHA-256 hash chain. Completed work carries an attestation by an identified user. The system is designed in alignment with 21 CFR Part 11 and EU GMP Annex 11.
No software vendor can sell you a compliant or validated system.
Compliance is a property of your processes, your validation, and how you operate the system in your environment. What a vendor can honestly offer is a product designed in alignment with the relevant requirements, and the documentation to support your own validation. That is what is described below, and we will not claim to have done your validation for you.
How do users sign in to MYREX?
Who the record names
The Entra-authenticated user, from your directory.
What MYREX does not hold
A separate local password for that person to remember, reuse or share.
Who controls the account
Your IT team, in the directory they already administer.
Where you revoke access
Entra, in the process you already run for leavers.
What does the SHA-256 hash chain guarantee, and what does it not?
The audit log is a chain. Each entry incorporates a cryptographic SHA-256 hash of the entry before it. Altering or removing any entry changes that entry’s hash, which breaks the link to every entry that follows it — so verification identifies not just that something changed, but the point in the log from which it changed.
Makes alteration or deletion detectable on verification
Does not prevent a sufficiently privileged actor from altering stored data.
Localises a break to the point in the log where the change was made
Does not tell you who made the change, if the change bypassed the application.
Covers maintenance records, attestations, and changes to procedure and work records
Does not cover every event in the system — administrative changes to user accounts and roles are recorded in the audit log but sit outside the chain, and verification does not walk them.
Preserves entries — nothing in the application updates or deletes them
Does not enforce a retention period, archive, expire, or apply a legal hold. There is no retention capability in the product.
That is what “tamper-evident” means here, precisely: not that alteration is impossible, but that alteration is detectable. Software alone cannot make a stored record impossible to change; it can make a change impossible to hide.
What is an attestation on completed work?
When work is completed in MYREX, the completion carries an attestation by the identified user who performed it — recorded against that person’s directory identity and the specific work. It is written to the audit log like every other action, which means it inherits the chain. Whether an attestation satisfies a signing requirement under a given predicate rule is a determination you make in your validation, against your own risk assessment. We describe the mechanism; we do not assert the conclusion on your behalf.
Your Data and Search is Protected.
Three answers worth giving before they are asked, because most software cannot give them.
No AI or machine-learning processing
No customer data is processed by any AI or machine-learning service. There is no such integration in the product.
No product telemetry
No product analytics, no session replay and no third-party error tracking. We do not instrument what your technicians do.
Transport encryption
Connections are encrypted in transit using TLS 1.2 or higher, verified on the storage account and on both application services.
Media — photos, video and scene files — is served through short-lived, backend-minted access links rather than persistent public URLs.
What ships today
Audit log, secured by a SHA-256 hash chain
Shipped
Attestation on completed work
Shipped
Microsoft Entra sign-in
Shipped
Asset pages with full activity history
Shipped
Search across assets, marks (pinned locations on the machine), media, procedures, procedure steps and activity
Shipped
What this page does not claim — ask us and we will answer in writing
A written answer for your environment is worth more to a reviewer than a capability list, and it is what we would rather send you.
Hosting region and data residency
The answer depends on your entity, your data and your regulator.
Data retention and archival configuration
Retention periods are set by your predicate rules and record-retention policy, not by us.
Penetration-test reports and vulnerability handling
Where a report exists, it is shared under the terms your security team would expect.
SOC 2, ISO 27001 and any other audit or certification program
This page names no certification and implies none. Ask for a current written statement of status, including where the answer is “not today.”
Data-processing terms and sub-processors
These are contract documents, read by the people who read contracts.
Records export for an inspection
Worth scoping against what your inspector actually asks for.
Validation support documentation
Scoped with each customer during onboarding.
User roles and the permissions model
Answered specifically against the separation of duties your procedures require.
Frequently asked
Can a vendor claim 21 CFR Part 11 compliance for MYREX?
No product can be. Part 11 compliance is achieved by a regulated company through its own procedures, validation and operation of a system. MYREX is designed in alignment with Part 11 and EU GMP Annex 11 — attributable identity through Microsoft Entra, attestation on completed work, and a tamper-evident audit log secured by a SHA-256 hash chain.
Does MYREX have electronic signatures?
MYREX records an attestation by an identified user on completed work. Whether that meets your requirement for a signing under a given predicate rule is a determination you make in your validation.
What does “tamper-evident” mean?
Each audit-log entry incorporates a cryptographic hash of the previous entry. Altering or deleting any entry breaks the chain from that point on, so the alteration is detectable. It means changes can be detected, not that they can be prevented.
Do technicians get their own MYREX accounts and passwords?
No separate password. Sign-in is through Microsoft Entra using the organization’s directory identity.
Our identity provider is not Microsoft. What then?
Sign-in is through Microsoft Entra today. If your directory is something else, ask us — that is a conversation about your environment.
Is MYREX SOC 2 or ISO 27001 certified?
This page makes no certification claim in either direction. Ask and you will get a current written statement of status, including where that status is “not today.”
Where is our data hosted?
Ask us — deployment and hosting specifics belong in a written answer for your environment.
Can you support our validation?
Yes, in the sense that is honestly available: we will answer your questions about the mechanism in writing and provide what documentation exists. Validation in your environment remains yours to perform.
Have a specific question?
Ask us and we will answer in writing, against your environment.