USE CASE
Maintenance records that hold up when an auditor asks who did it, where, and when
MYREX records maintenance work with an attestation on completion and writes those records — procedures, work records, attestations and the changes to them — to an audit log secured by a SHA-256 hash chain — a design aligned with 21 CFR Part 11 and EU GMP Annex 11. The record also carries something most maintenance records do not: the evidence — photos, video and notes — pinned to the exact spot on the machine it was taken at.
A necessary distinction, first not last: no software vendor can sell you a compliant or validated system. Compliance is a property of your processes, your validation, and how you operate the system in your environment. What a vendor can honestly offer is a product designed in alignment with the relevant requirements, and the documentation to support your own validation. Where MYREX does not do something, this page says so.
What does 21 CFR Part 11 actually require of a maintenance record?
Part 11 governs electronic records and electronic signatures where they are used in place of paper under FDA-regulated predicate rules. For maintenance records, the requirements that bite in practice are: records must be attributable to an identified individual, protected from undetected alteration, retained and retrievable through the record’s retention period, and — where a signing is required — carry a signature manifestation that is linked to the record it signs. EU GMP Annex 11 covers the same ground for the EU, with its own emphasis on risk assessment, supplier assessment, and audit trails that are reviewable.
Where a maintenance program usually fails an audit is not the software. It is a preventive maintenance (PM) task that was performed three weeks late with no documented rationale, or a completed work order with no evidence the person who signed it was qualified to do the work. Software can make those visible. It cannot make them not have happened.
How does MYREX record who did the work?
Sign-in is through Microsoft Entra, so the identity in the record is the organization’s own directory identity, not a local application account with a shared password taped inside a cabinet door. Completed work carries an attestation by that identified user. Work on maintenance records — creation, assignment, edit, completion, attestation — is written to an audit log. The log is secured by a SHA-256 hash chain: each entry incorporates a cryptographic hash of the one before it, so an entry cannot be altered or removed after the fact without breaking the chain from that point forward. That is what “tamper-evident” means here, precisely: not that alteration is impossible, but that alteration is detectable. Administrative changes to accounts and roles are recorded but currently sit outside that chain, and verification does not walk them.
What does the location on the record add?
A conventional maintenance record answers what task, which asset, who, when. In MYREX the evidence attached to that record also answers where on the asset.
“Show me the last three times this seal was replaced.”
Conventional: search work orders for the asset, read task descriptions, hope the wording was consistent. MYREX: open the location; the history of that spot is the history of that spot.
“How do you know the technician worked on the right unit?”
Conventional: the work order says so. MYREX: the work is done against a specific asset, with the evidence media pinned to the spot on that machine.
“Show me the evidence photo.”
Conventional: attached to a work order, filed by date. MYREX: attached to the location, alongside every other image ever taken there.
“Who attested to this, and when?”
Conventional: audit log. MYREX: audit log, hash-chained.
What ships today, and what does not
Attestation on completed work
Shipped
Audit log, secured by a SHA-256 hash chain
Shipped
Microsoft Entra sign-in
Shipped
Asset pages with full activity history
Shipped
Photos, video and notes pinned to exact locations on the machine
Shipped
Preventive maintenance (PM) calendar with recurring events linked to locations on the machine
Shipped
Manager dashboard — open, overdue, due-today and unassigned counts, with due dates
Shipped
Search across assets, marks, media, procedures, procedure steps and activity
Shipped
Per-step location anchoring of procedures
In development
Spanish (LatAm)
In development
Ask us about these rather than assuming — if it is not in the table above, it is not a claim we are making on this page: retention and archival policy configuration, records export format for an inspection, electronic-records validation documentation package, role-based approval workflows beyond attestation, and deployment options. We would rather answer specifically for your environment than list capabilities generically. The audit chain covers maintenance records — procedures, work records and attestations, and changes to them; administrative changes to accounts and roles are recorded but sit outside the chain, and verification does not walk them.
Frequently asked
Can a vendor claim 21 CFR Part 11 compliance for MYREX?
No product can be. Part 11 compliance is achieved by a regulated company through its own procedures, validation and operation of a system. MYREX is designed in alignment with Part 11 and EU GMP Annex 11 — attributable identity through Microsoft Entra, attestation on completed work, and a tamper-evident audit log secured by a SHA-256 hash chain.
Does MYREX have electronic signatures?
MYREX records an attestation by an identified user on completed work. Whether that meets your requirement for a signing under a given predicate rule is a determination you make in your validation, and we will support it with the detail you need.
What does “tamper-evident” mean?
Each audit-log entry incorporates a cryptographic hash of the previous entry. Altering or deleting any entry breaks the chain from that point on, so the alteration is detectable. It means changes can be detected, not that they can be prevented.
Can we use MYREX in a GMP environment?
Companies in regulated manufacturing are the intended users. The system is designed in alignment with 21 CFR Part 11 and EU GMP Annex 11, and validation in your environment remains yours to perform. Ask us what documentation we can provide to support it.
Is our data hosted in our region?
Ask us — deployment and hosting specifics belong in a written answer for your environment, not in a marketing paragraph.
See it on your own machine.
Bring a machine you already know is a mess to explain, and we will show you what it looks like inside MYREX.