Your CMC data stays on your computer. Here is how to check.
Most pharma companies won’t put unpublished CMC data into a web service, and they’re right not to. CMCfy is built so that it never has to.
The policy
A Content Security Policy that blocks every connection except AI
Every tool page is served with this Content Security Policy. connect-src lists only AI endpoints, by exact address: CMCfy AI and the official Claude and OpenAI-style endpoints a company may use with its own account. The page contacts one only when you press an AI button and approve the exact text it shows you. Files, data and calculations are never sent. The offline copy blocks every connection, AI included.
default-src 'none'; connect-src https://app.cmcfy.com/api/ai https://api.anthropic.com/v1/messages https://api.openai.com/v1/chat/completions … (AI endpoints only, by exact address); script-src https://app.cmcfy.com/app/lib/ 'unsafe-inline' 'wasm-unsafe-eval'; style-src 'unsafe-inline'; img-src data: blob:; font-src 'none'; form-action 'none'; frame-ancestors 'none'
The pages load no fonts, analytics or scripts from other sites. PDF and scan reading runs in the page too, so a scanned batch record is read on your computer.
Check it
Three ways for IT to verify that no data leaves
- Watch the counterEvery tool shows "Network requests since load", counted by the browser. It stays at 0 unless you run an AI step, and then it names the AI address.
- Open developer toolsThe Network tab stays empty while you load files, calculate and download. An AI step shows one request, holding only the text you approved.
- Unplug the networkUse the offline copy on a PC with no connection. Calculations, review and Word export still work.
Also
What we keep, and what we don’t
What we keep
Your login and your subscription. Nothing you load or write in the tools.
AI, only if you ask
AI runs only when you click it, after you see exactly what text will be sent. CMCfy AI (Claude or OpenAI) keeps no copy and no log. Enterprise can connect its own Anthropic, AWS Bedrock, Azure, Google Vertex, OpenAI or xAI account instead, or switch AI off.
Fixed releases
Each release is versioned and documented, so QA can qualify one version and know it won't change underneath them.
People sign
Every report carries sign-off lines and a review notice. CMCfy drafts; your qualified people approve.
Questions
Questions QA asks about data, AI and GxP
What does CMCfy write for CTD Module 3?
The CTD quality sections for drug substance (3.2.S) and drug product (3.2.P), the appendices (3.2.A) and regional information (3.2.R), for small molecules and biologics. The QOS Composer then writes the Quality Overall Summary (Module 2.3) from the same data and lists facts that disagree between sections. CMCfy also writes the GMP reports behind the dossier, such as stability, method validation, PPQ, cleaning validation and the annual product review.
Are the files ready for an eCTD submission?
Each section downloads as Word or PDF, and the QOS Composer arranges your files in the eCTD Module 2 and Module 3 folder structure. Your publishing tool still builds the eCTD backbone and validates the sequence, and your qualified people review and approve the content first.
Is CMCfy a validated GxP system?
CMCfy is a drafting and calculation aid. Your qualified people review and approve every report, and the final record lives in your own document system. For customers who qualify the tool, we provide release notes, test evidence and a validation support pack.
Does any of our data reach CMCfy servers?
No. Calculations and report generation run in the browser on your computer. The only things CMCfy stores are your account login and subscription. If you run a CMCfy AI step, the text you approve passes through to the AI provider and is not stored or logged by CMCfy. You can confirm this with your browser's network tools or by using the offline copy.
Where does the AI run?
Only where you choose. On Pro and Team plans, CMCfy AI runs under a zero-data-retention agreement. Enterprise customers can connect their own Anthropic, AWS Bedrock, Azure, Google Vertex, OpenAI or xAI account, so the text goes straight from the browser to their account and CMCfy never sees it. AI can also be switched off. You always see the exact text before it is sent, and AI never changes calculated numbers or pass/fail outcomes.
Which guidelines do the tools follow?
ICH M4Q(R1) for the CTD structure; ICH Q1A(R2) and Q1E for stability; Q2(R2) and Q14 for methods; Q3A–Q3D, M7, Q6A and Q11 for small molecules; Q5A(R2), Q5B, Q5D, Q5E and Q6B for biologics. For the US, FDA guidance and USP; for the EU, EMA guidelines and Ph. Eur. Each section cites the guideline it follows for the region you pick.
Can it read our existing documents?
Yes. The tools read Excel, CSV, Word, PDF, OpenDocument and RTF files, and scanned pages or photos through text recognition that also runs on your computer. Scanned text shows a confidence score so you can check it.
Can we use our own report templates?
Yes, on the Team and Enterprise plans. Company templates control headings, wording and layout, while the calculations stay the same.
Judge it on a section you already wrote
Paste a section into the Report Reviewer and read what it finds. Nothing you paste leaves your computer.