A pharma company that installs a new computer system has to prove, on paper, that the system does what it should. That paper runs to dozens of documents per system, and every signature on it may be read by an auditor years later.
ValiDoc is our portal for that work.
Documents as data
The design decision that mattered most: a document type is a specification, not a screen. Its sections, fields, rules and output layout live in data. Adding a new type means writing its spec, not building a new page.
That is why the portal went from 14 document types to 49 in about three weeks. It now defines 50, across 8 phases:
| Phase | Examples from the portal |
|---|---|
| Change control | Change Control SOP |
| Requirements and specification | URS, Functional and Design Specifications |
| Planning and reporting | GxP Assessment, Validation Plan, Validation Summary Report |
| Risk management | System Risk Assessment, FMEA, Traceability Matrix, Part 11 Assessment |
| Testing and qualification | IQ, OQ, PQ and UAT Protocols, Test Summary Report |
| Vendor and supplier | Vendor Assessment Questionnaire, Supplier Audit Checklist |
| SOPs | Backup and Restore, Access Management, Incident Management |
| Operational | Security Assessment, Data Integrity Assessment, Periodic Review Report |
Built for the auditor
- Electronic signatures under 21 CFR Part 11. Approving a document needs the user's password and a signature bound to a hash of the document's content, in one transaction. Change the content and the signature no longer matches.
- Evidence with fingerprints. Test evidence is attached with SHA-256 references, so a file swapped later is detectable.
- Version comparison and review comments on every document.
- Output auditors expect. Word files on the customer's own letterhead, with document history, a signature panel and a table of contents.
Shipping safely
The portal runs on Next.js with Prisma and MySQL. Releases build in parallel and switch over only when the build succeeds, with automatic rollback. For a system auditors rely on, a broken release must never reach users.
What carries over to client work
Whenever a business produces many documents of the same shape, the win is to treat each type as a specification. New requirements become data changes, and every output stays consistent.