The answers your QA and IT reviewers will ask for, in one place.
Where data goes, who we use, how CMCfy maps to 21 CFR Part 11 and EU GMP Annex 11, and the validation documents. Download it as one PDF for your supplier file.
For IT
What leaves your computer, and what never does
| Item | Where it is handled | Leaves your computer? |
|---|---|---|
| Files you load (Excel, Word, PDF, scans) | Read on your computer | Never sent |
| Calculations, pass/fail, statistics | Run on your computer | Never sent |
| Projects, versions, audit trail, lab notebook | Saved in a folder your company picks | Never sent |
| Word and PDF reports | Written on your computer | Never sent |
| CMCfy Writer text (only when you press it) | You see and approve the exact text first | Sent once to the writing service; no copy kept |
| Your login and subscription | Held by our sign-in and billing providers | No CMC data in them |
Every tool page carries a Content Security Policy that blocks all other connections, and shows a live count of network requests. How IT can verify it in minutes.
Providers
The third parties that touch the service, and what each one sees
| Provider | Used for | What it sees |
|---|---|---|
| Cloudflare | Hosts cmcfy.com and app.cmcfy.com | Page requests only. Tool pages send no data back. |
| Anthropic (Claude models) | CMCfy Writer, only when a user presses it | The approved text of that one request. CMCfy keeps no copy; not used to train models. |
| Sign-in and billing providers | Accounts and subscriptions | Name, work email, company and plan. No CMC data. |
| Your own cloud account (Enterprise) | CMCfy Writer through your Anthropic, AWS Bedrock, Azure, Google Vertex, OpenAI or xAI account | Under your contract, or switch CMCfy Writer off. |
For QA
How CMCfy maps to 21 CFR Part 11 and EU GMP Annex 11
| Requirement | What CMCfy provides | What stays with you |
|---|---|---|
| 11.10(a) Validation | Automated IQ/OQ (21 scripted tests) plus supplier documents VAL-01 to VAL-08 | You run PQ for your intended use (VAL-10 template) |
| 11.10(b) Accurate and complete copies | Word, PDF and CSV exports; versions read back exactly | — |
| 11.10(c) Protection of records | Records are plain files in your folder; each version is fingerprinted | Backup and retention of that folder |
| 11.10(d) Limiting access | Named user on every audit-trail entry and signature | Access to the project folder and computers |
| 11.10(e) Audit trail | Chained, time-stamped (UTC) entries with old and new values, user and reason; edits outside CMCfy show as altered | Review the audit trail per your SOP |
| 11.10(f)-(h) Operational and device checks | Required steps and blocking checks in each tool; release fingerprint checked by IQ-01 | — |
| 11.10(i) Training | A training guide and PDF for every module | Your training records |
| 11.10(k) System documentation | Versioned releases with a manifest; our SOP-01 to SOP-04 | — |
| 11.50 / 11.70 Signatures | Printed name, date, time and meaning, bound to the content signed; a signed entry is locked | Your e-signature policy |
| Annex 11 §4, §11 Validation and periodic review | Each release is versioned, so you qualify one version and know it will not change underneath you | Periodic review |
| Annex 11 §7 Data storage | No CMC data on our servers | Your storage and backup |
The full clause-by-clause assessment is document VAL-08 in the validation pack.
Documents
The validation pack
| Document | Title | Owner |
|---|---|---|
| VAL-01 | Supplier statement and validation summary | CMCfy |
| VAL-02 | User requirements specification (baseline) | CMCfy, adopted by you |
| VAL-03 | Functional specification | CMCfy |
| VAL-04 | Risk assessment | CMCfy, reviewed by you |
| VAL-05 / 06 | IQ and OQ protocols (automated on the validation page) | Run by you |
| VAL-07 | Traceability matrix | CMCfy |
| VAL-08 | 21 CFR Part 11 and EU GMP Annex 11 assessment | CMCfy and you |
| VAL-09 to 11 | Validation plan, PQ protocol and summary report templates | You |
| SOP-01 to 04 | Our development and change control, defects, release approval and training procedures | CMCfy |
The Word documents come with Team and above, or on request during an evaluation.
Change control
Fixed releases, and guidance kept current
Versioned releases
Each release has a date, a build fingerprint and a manifest of every page. The IQ checks the fingerprint, so you qualify one version and know it won't change underneath you.
Guidance kept current
We check every guideline CMCfy cites against the agencies’ own sites. When a new version comes into force, the tools, the review checklists and the training guides are updated within 30 days, and the change is listed on the update log. See the update log.
People sign
CMCfy drafts and flags. Your qualified people review, justify and sign every report.
Reporting a security issue
Write to sales@cmcfy.com (subject "Security"); see cmcfy.com/.well-known/security.txt.
Send this to your QA and IT reviewers
One PDF with everything on this page, ready for your supplier qualification file.