🎯Intended useLive
TrainSync is the GxP training operations layer for pharma and biotech manufacturing teams. Its intended uses are:
- Planning and scheduling of classroom and on-the-job training sessions
- Maintaining a live skill matrix of personnel competence per training
- Capturing sequential GxP sign-off on training records
- Producing exportable evidence (CSV, XLSX, PDF) for audit purposes
- Supporting customer validation activities through an audit trail and template versioning
TrainSync is not intended to:
- Be the validated source of training content (your LMS does that)
- Replace your QMS for document control of SOPs
- Self-certify Part 11 compliance — that determination is made by your QA team
📐GAMP 5 categorisationDraft
Our preliminary view, subject to customer QA assessment: TrainSync is best characterised as GAMP 5 Category 4 (configured product).
- It is a commercially available SaaS product
- Customers configure roles, skill levels, templates, and training catalogue without modifying source code
- The configuration affects behaviour but the underlying code is the same for all customers
If your QA framework places SaaS training tools differently (e.g., Cat 4 + Cat 5 hybrid for the signature workflow), we will document it according to your conventions during the validation engagement.
📜Audit trail mechanismLive
The audit trail is implemented at the database layer using PostgreSQL triggers, not at the application layer. This means a user, even an administrator, cannot bypass the audit trail by issuing a direct API call.
| Aspect | Implementation |
|---|---|
| Tables audited | people, trainings, sessions, enrollments, person_trainings, signature_documents, signature_steps |
| Actions captured | insert, update, delete, sign, na, reassign, override |
| Fields per entry | table name, record ID, action, actor (resolved to internal person), before/after JSON, IP address, server timestamp, tenant ID |
| Mutability | append-only at the policy layer (no UPDATE or DELETE policy on audit_log) |
| Timestamp source | Database server time (UTC). RFC 3161 trusted timestamping available on request. |
| Audit review | Planner and admin roles can read audit entries via SQL or planned audit-views UI (Week 3-4) |
✍️E-signature control matrixDrafting
Mapping of TrainSync's signature workflow against 21 CFR Part 11 §11.50, §11.70, and §11.200:
| Control | Part 11 reference | Status in TrainSync |
|---|---|---|
| Unique user identity | §11.200(a)(1) | Live — Clerk enforces unique email per user |
| No shared accounts | §11.200(a)(2) | Live — enforced by Clerk; customer SOP required |
| Re-authentication at signature | §11.200(a)(1)(ii) | Drafting — currently uses active session; password re-prompt is on the roadmap |
| Signature meaning | §11.50(a)(2) | Live — each step captures role and label (trainee, trainer, supervisor, QA) |
| Printed name + date/time | §11.50(a)(1) | Live — captured automatically from authenticated user |
| Permanent link to record | §11.70 | Live — signature steps are foreign-keyed to signature_documents and cannot be migrated independently |
| Audit trail of changes | §11.10(e) | Live — database-level trigger |
| Authority checks | §11.10(g) | Live — role-based access control via RLS |
| Reason for change | §11.10(e) | Live — N/A rationale, reassign reason, override reason all captured |
Customer QA validates each control during the validation engagement.
🇪🇺EU GMP Annex 11 mappingDrafting
Mapping against the most frequently cited Annex 11 paragraphs:
| Annex 11 paragraph | Topic | Status in TrainSync |
|---|---|---|
| 4 (Validation) | System validation | Customer responsibility; validation pack drafting in Q3 2026 |
| 7 (Data) | Data integrity | Live — ALCOA+ controls (Attributable, Legible, Contemporaneous, Original, Accurate) |
| 8 (Printouts) | Printable copies | CSV/XLSX live; PDF in beta (Week 2) |
| 9 (Audit trails) | Audit trail | Live — see audit trail section above |
| 10 (Change & configuration) | Change control | Customer SOP required; TrainSync change log via Changelog page |
| 12 (Security) | Access control | Live — RBAC, RLS, Clerk authentication |
| 13 (Incident management) | Incident handling | Drafting — formal policy is a Week 4 deliverable |
| 14 (Electronic signature) | E-signature | See e-signature control matrix above |
| 17 (Archiving) | Long-term archival | 5+ year retention; data export on request |
⏳Data retentionLive
See the data retention table in our privacy policy. Summary:
- GxP training records & signatures: minimum 5 years (or as required by applicable GMP/GxP regulation)
- Account data: for the duration of the contract, plus 30 days for export, then deletion
- Audit logs: retained for the same duration as the records they audit
- Backups: rolling 30-day retention window after deletion
📋Template versioningDrafting
TrainSync's signature templates support versioning. Each completed record is linked permanently to the template version used at the time of signing. Templates can be:
- Drafted — editable, not usable for production records
- Active — used for new records; cannot be modified in place (only retired and superseded by a new version)
- Retired — no longer used for new records, but historical records remain linked to it
Template approval workflow (with electronic signature for template approval itself) is a Q3 2026 roadmap item.
📦Validation pack (URS / IQ / OQ / PQ)Q3 2026
The full validation pack is in active drafting. Target completion is Q3 2026. It will include:
- User Requirements Specification (URS) — what TrainSync does, in your QA framework's language
- Validation Plan — how the customer validates TrainSync for their site
- Installation Qualification (IQ) — scripts to verify the deployed instance matches the specification
- Operational Qualification (OQ) — scripts to verify each feature behaves correctly
- Performance Qualification (PQ) — scripts to verify TrainSync performs in the customer's operational environment
- Traceability matrix — every requirement mapped to its test case
Until the pack is published, we share what's drafted on request during validation engagements.
Need this in a specific format for your QA team?
Validation packs, e-signature questionnaires, and Part 11 / Annex 11 mappings can be tailored to your organisation's framework. Book a 30-minute call and we'll plan the engagement.
Book a QA conversation →