A new category of regulated operations infrastructure
Built. Tested.
Proven in production.
Node.js · React · MongoDB Atlas — single unified stack, zero tech debt, zero legacy subsystems. 106 purpose-built AI agents. Full compliance architecture enforced at the core — not configured on top.
What's under the hood
A complete, production-deployed SaaS platform — not a prototype, not an MVP. Every major workflow is built, tested, and running in a live lab today.
Per-Tenant Isolated Databases
Not row-level filtering. Every lab tenant receives a dedicated database instance. Cross-tenant data access is architecturally impossible — enforced by structure, not policy.
Single Unified JavaScript Stack
Purpose-built for regulated operations — one coherent platform, no polyglot sprawl, no legacy subsystems, zero tech debt.
AES-256-GCM Encryption
All sensitive data encrypted at rest with AES-256-GCM. TLS in transit. Credentials and integration secrets protected with tamper detection.
Bring-Your-Own Storage
S3-compatible storage layer supports AWS, Backblaze, DigitalOcean, Wasabi, Cloudflare R2, Azure Blob, and MinIO. Zero vendor lock-in on document storage.
AI Layer Built In, Not Bolted On
106 purpose-built AI agents embedded across every module. Every workflow was designed around AI from day one — not adapted after the fact.
White-Label Multi-Tenant Infrastructure
Every tenant deploys under their own brand — logo, colors, domain, email sender, and PDF templates. The platform is invisible. The lab's brand is front and center.
Proof it's not a prototype
The test infrastructure alone took months to build. It runs automatically — and every release must pass before it ships.
Including live 2FA verification, COA immutability probes, negative-path security tests, and compliance-only 21 CFR Part 11 assertions — not just happy-path smoke tests.
Covering every major workflow: COC, COA, QMS, SQF, Pharma/GMP, CLIA, EMR Integration, Ingest API, Client Portal, Trust & Compliance, equipment calibration, invoicing, AI agents, user personalization (saved filters, notification prefs, dashboard layout, custom fields, departments), and stress testing.
Live system health score updated on every test run. Reviewed before every release. Not a vanity metric — a gating requirement.
Chain of Custody, Certificate of Analysis, COA Inspection Package, CAPA, Deviations, Complaints, Supplier, Internal Audit, Validation VSR, Agreement, Sample Worksheet, CLIA Audit Report, ISO 17025 Audit Report, Invoice.
Latest system test
Health score · July 14, 2026
811
Tests passed
0
Failures
77
Suites
Full report available in Platform Admin → System Tests
Live score from the System Test Agent — updated on every test run.
Platform Reference
What's Actually Built
Live figures — source of truth: platformStats.js · last full run July 14, 2026
AI-NATIVE. · COMPLIANT BY DESIGN. · BUILT FOR TRUST.
The test suite is the due diligence receipt.
Most software companies tell you their platform is reliable. We run 811 automated end-to-end tests against our live platform every month and publish the results. The health score, failure count, and run date are visible in the Platform Admin dashboard — not a static page, a live result.
Labs operating under FDA, CLIA, and ISO 17025 cannot be our beta testers. Every feature ships after passing 811 tests — including live 2FA verification, COA immutability probes, audit trail append-only enforcement, and negative-path security checks. This is the minimum viable standard for regulated software.
For technical evaluators: this is your due diligence receipt. It tells you exactly what every module does, what every security control enforces, and what would break if someone changed the architecture without understanding it. Most platforms at any valuation cannot offer this. We publish it monthly.
A complete QMS — not an add-on.
CAPA, deviations, SOPs, internal audits, management reviews, and proficiency testing. The equivalent of Q-Pulse or MasterControl, built into the same platform as your testing and certification operations.
Compliance built into the architecture
Not configurable options. Not marketing claims. Architectural enforcement — the kind that holds up in an FDA inspection.
21 CFR Part 11 — Architectural Enforcement
- Tamper-evident audit trail on every action — user, IP, timestamp, affected record
- Re-authentication required before every critical signature (COA issue, SOP sign-off)
- Electronic signature declaration (§11.100(c)) included in the Vendor Validation Package
- AI-powered readiness assessment scores your live system across 10 Part 11 categories
Vendor Validation Package (VVP)
- 25+ page auto-generated IQ/OQ/PQ documentation bundle
- Full Requirements Traceability Matrix (RTM)
- GAMP 5 classification framework
- Executed test cases and PQ templates included
- Drop directly into a Computer System Validation binder
COA Immutability — No Admin Bypass
- Once a COA is issued, no one can edit it — not platform admins, not us
- SHA-256 cryptographic hash on every issued COA
- Tamper detection via integrity check endpoint
- Backed by 5-year immutable audit log retention
- Metrological traceability chain — calibration cert to COA, per ISO 17025 §6.6
- Automated calibration expiry validation on certificate issuance — blocks if expired
Training Currency Enforcement
- Hard block on SOP sign-off if training is expired — not a warning, a system-level block
- Training records linked to SOPs, equipment sign-offs, and COA approvals
- Expiry tracked automatically across all lab staff
Granular RBAC & Separation of Duties
- Permission-level access control beyond role presets — grant or revoke individual actions per user
- Admin Compliance Agent detects ISO 17025 / FDA SoD conflicts before you save
- Every permission change audit-logged with reason and the admin who made it
- Department groupings with area-default test methods and equipment assignments
FAIR Data Publishing
- Persistent FAIR identifier minted for every issued lab report — format: FAIR-{tenant}-{reportId}-{hex}
- Sharing status: private / restricted / public — public reports served via stable URL, no login required
- schema.org JSON-LD export for data repositories; DataCite-compatible JSON for DOI deposit via Zenodo, Dryad, or Figshare
- PI ORCID iD and institution ROR identifier captured per report — machine-readable, funder-mandate ready
- Funder mandate field supports NIH Data Management and Sharing Policy, Horizon Europe, and NSERC DORA
Grant Tracking & F&A Cost Allocation
- Grant records with agency, award number, PI, budget, indirect rate, milestones, and required standards
- Direct cost allocation from individual lab reports and sample submissions to grants
- F&A (facilities & administrative) overhead computed automatically from the grant's negotiated indirect rate
- NIH 15% MTDC cap enforcement in the built-in F&A calculator
- Live burn-rate dashboard — colour-coded spend alerts at 60% and 85% of total budget
EU AI Act Compliance (Articles 9–17)
- Automated assessment maps 9 EU AI Act articles to existing AILS controls — no manual evidence gathering
- Article 14 (Human Oversight): re-auth on COA signing, manager override with re-auth, RBAC-enforced issuance gate
- Article 17 (QMS): full quality management system — CAPA, audits, deviations, training, risk, proficiency testing
- Article 15 (Cybersecurity): AES-256-GCM encryption, TOTP 2FA, 811 automated tests with adversarial pen-test scenarios
- AI Act Compliance Advisor agent answers compliance questions based on your specific assessment results
- Download a regulator-ready PDF gap report to hand to an auditor or a supervisory authority
Agent Self-Reporting Loop — Always-On Health Monitoring
AILS watches itself 24/7. When something needs attention, it tells you what it found, what it recommends, and waits for your approval.
Agent Runtime Self-Reporting
Agents detect their own failures or poor output in production and file a ticket — after a hardcoded safety-boundary check (protected paths & security keywords never enter the auto-fix pipeline).
→System Test Suite Integration
Automated health tests catch issues before users do. Runtime failures and test failures share one pipeline.
→AI Code Analysis → Diagnosis
Medium-severity tickets trigger AI analysis of the failing route: root cause, proposed unified-diff fix, blast-radius and risk assessment.
→Human Approval Gate
Mandatory. AI proposes, humans decide, architecture enforces. Approve, reject, or request revision — with one-click rollback available.
→AI Health Report Integration
Agent health flows into the monthly system-test report — distinguishing infrastructure issues from single-agent prompt/parsing issues.
Key insight: test failures and runtime failures share one pipeline — every failure is caught, diagnosed, and human-approved before any fix deploys.
Five interlocking systems: agent runtime self-reporting → system test suite → AI code analysis & diagnosis → mandatory human approval gate → AI health report integration. Every failure is caught, diagnosed, and human-approved before any fix is deployed.
106 purpose-built AI agents
Not a generic chatbot layer. 106 specialized agents with deep operational context, embedded in every module — with full per-tenant data scoping.
All 106 agents are scoped to the tenant's live data — fully private, no cross-tenant access.
Enterprise integrations
Bidirectional connections to the systems your enterprise already runs — no middleware, no implementation project, no consultant required.
Native SAP Quality Management bridge
Direct SAP QM interoperability — COA results out, inspection lots in, no middleware. AILS pushes finished COA results into SAP inspection lots and pulls new inspection lot requests from SAP to create COCs automatically — closing the loop between your lab and your enterprise ERP without a middleware layer.
- Bidirectional sync — COA results out, inspection lots in
- AI-guided setup agent with live connection testing
- No middleware, no ETL pipeline, no implementation project
- Full audit trail on every push and pull event
CRM sync — connect lab ops to your sales pipeline
Link your lab workflow directly to Salesforce. Push quotes, COA certificates, and results to contacts and opportunities — keeping your CRM and lab data aligned without manual re-entry.
- Push COA certificates and results to Salesforce contacts
- Sync quotes and proposals to Salesforce opportunities
- Browse your Salesforce product catalogue from within AILS
- AI-guided OAuth connection setup
EMR integration — HL7 FHIR R4
HL7 FHIR R4 connector for clinical labs. Inbound orders and outbound results over FHIR, AI-assisted field mapping, and a sync-log agent that monitors every transaction and surfaces issues before they become compliance events.
- Inbound order / outbound result sync via HL7 FHIR R4
- Works with FHIR-compatible EMRs (Epic, Cerner, Meditech)
- AI field mapping agent — no manual schema work
- Sync log review and troubleshooting via agentic tool loop
What would it cost to build this from scratch?
Building a multi-tenant regulated operations platform with this level of compliance architecture, AI integration, and test coverage from scratch takes years and a full engineering team. The platform is built. The compliance is baked in. The AI layer is running. What's left is putting it in the right hands.
See the infrastructure live.
Six sandbox environments. Real compliance data. AI guide included. Just your email.