A new category of regulated operations infrastructure
Built. Tested.
Proven in production.
Single unified stack, zero tech debt, zero legacy subsystems. 112 purpose-built AI agents. Full compliance architecture enforced at the core — not configured on top.
What's under the hood
A complete, production-deployed SaaS platform — not a prototype, not an MVP. Every major workflow is built, tested, and running in a live lab today.
Tenant-Scoped Data Isolation
Every query is scoped to the tenant ID from the authenticated session, checked by a 22-test isolation suite on every release. A tenant that needs its data held separately gets a dedicated database through bring-your-own database or EU hosting.
Single Unified Stack
Purpose-built for regulated operations — one coherent platform, no polyglot sprawl, no legacy subsystems, zero tech debt.
Application-Level Encryption
Connection strings, tokens, API keys, and 2FA secrets encrypted at the application level. TLS in transit. Storage-level encryption at rest is provided by the hosting provider.
Bring-Your-Own Storage
S3-compatible storage layer — bring your own bucket from any major cloud provider. Zero vendor lock-in on document storage.
AI Layer Built In, Not Bolted On
112 purpose-built AI agents embedded across every module. Every workflow was designed around AI from day one — not adapted after the fact.
White-Label Multi-Tenant Infrastructure
Every tenant deploys under their own brand — logo, colors, domain, email sender, and PDF templates. The platform is invisible. The lab's brand is front and center.
Proof it's not a prototype
The test infrastructure alone took months to build. It runs automatically — and every release must pass before it ships.
Including live 2FA verification, CoA lock-after-issue probes, negative-path security tests, and compliance-only 21 CFR Part 11 assertions — not just happy-path smoke tests.
Covering every major workflow: COC, COA, QMS, SQF, Pharma/GMP, CLIA, EMR Integration, Ingest API, Client Portal, Trust & Compliance, equipment calibration, invoicing, AI agents, user personalization (saved filters, notification prefs, dashboard layout, custom fields, departments), and stress testing.
Live system health score updated on every test run. Reviewed before every release. Not a vanity metric — a gating requirement.
Chain of Custody, Certificate of Analysis, COA Inspection Package, CAPA, Deviations, Complaints, Supplier, Internal Audit, Validation VSR, Agreement, Sample Worksheet, CLIA Audit Report, ISO 17025 Audit Report, Invoice.
Latest system test
Health score · October 1, 2026
1232
Tests passed
0
Failures
102
Suites
Full report available in Platform Admin → System Tests
Live score from the System Test Agent — updated on every test run.
Platform Reference
What's Actually Built
Live figures — source of truth: platformStats.js · last full run October 1, 2026
AI-NATIVE. · COMPLIANT BY DESIGN. · BUILT FOR TRUST.
The test suite is the due diligence receipt.
Most software companies tell you their platform is reliable. We run 1232 automated end-to-end tests against our live platform every month and publish the results. The health score, failure count, and run date are visible in the Platform Admin dashboard — not a static page, a live result.
Labs operating under FDA, CLIA, and ISO 17025 cannot be our beta testers. Every feature ships after passing 1232 tests — including live 2FA verification, CoA lock-after-issue probes, audit trail append-only enforcement, and negative-path security checks. This is the minimum viable standard for regulated software.
For technical evaluators: this is your due diligence receipt. It tells you exactly what every module does, what every security control enforces, and what would break if someone changed the architecture without understanding it. Most platforms at any valuation cannot offer this. We regenerate and publish it with every release.
A complete QMS — not an add-on.
CAPA, deviations, SOPs, internal audits, management reviews, and proficiency testing. The equivalent of Q-Pulse or MasterControl, built into the same platform as your testing and certification operations.
Compliance built into the architecture
Not configurable options. Not marketing claims. Controls enforced in code — the evidence your own validation cites.
21 CFR Part 11 — Controls Enforced in Code
- Tamper-evident audit trail on every action — user, IP, timestamp, affected record
- Re-authentication required before every critical signature (COA issue, SOP sign-off)
- Electronic-signature controls and documentation supporting your §11.100(c) certification — included in the Vendor Validation Package
- AI-powered readiness assessment scores your live system across 10 Part 11 categories
Vendor Validation Package (VVP)
- 25+ page auto-generated IQ/OQ/PQ documentation bundle
- Full Requirements Traceability Matrix (RTM)
- GAMP 5 classification framework
- OQ protocols and PQ templates your quality function executes and signs
- Drop directly into a Computer System Validation binder
CoA Locked After Issue — No Admin Bypass
- Once a COA is issued, no one can edit it — not platform admins, not us
- SHA-256 cryptographic hash on every issued COA
- Tamper detection via integrity check endpoint
- Backed by 5-year tamper-evident audit log retention
- Metrological traceability chain — calibration cert to COA, per ISO 17025 §6.6
- Automated calibration expiry validation on certificate issuance — blocks if expired
Training Currency Enforcement
- Hard block on SOP sign-off if training is expired — not a warning, a system-level block
- Training records linked to SOPs, equipment sign-offs, and COA approvals
- Expiry tracked automatically across all lab staff
Granular RBAC & Separation of Duties
- Permission-level access control beyond role presets — grant or revoke individual actions per user
- Admin Compliance Agent detects ISO 17025 / FDA SoD conflicts before you save
- Every permission change audit-logged with reason and the admin who made it
- Department groupings with area-default test methods and equipment assignments
FAIR Data Publishing
- Persistent FAIR identifier minted for every issued lab report — format: FAIR-{tenant}-{reportId}-{hex}
- Sharing status: private / restricted / public — public reports served via stable URL, no login required
- schema.org JSON-LD export for data repositories; DataCite-compatible JSON for DOI deposit via Zenodo, Dryad, or Figshare
- PI ORCID iD and institution ROR identifier captured per report — machine-readable, funder-mandate ready
- Funder mandate field supports NIH Data Management and Sharing Policy, Horizon Europe, and NSERC DORA
Grant Tracking & F&A Cost Allocation
- Grant records with agency, award number, PI, budget, indirect rate, milestones, and required standards
- Direct cost allocation from individual lab reports and sample submissions to grants
- F&A (facilities & administrative) overhead computed automatically from the grant's negotiated indirect rate
- NIH 15% MTDC cap enforcement in the built-in F&A calculator
- Live burn-rate dashboard — colour-coded spend alerts at 60% and 85% of total budget
Quotes & Contracts (ISO/IEC 17025 cl. 7.1)
- Review-of-request refusals, not a checklist someone can click past — a statement of conformity with no stated decision rule cannot be issued
- Two independent sign-offs, each hashed to the exact terms signed: the lab's own review and the customer's acceptance
- One person cannot both review a contract and record the customer's acceptance of it
- Amending an accepted contract versions it — the prior, signed version stays readable and still verifies, never edited in place
- No module gate — the same cl. 7.1 review a testing lab, an inspection body, and a certification body each need, in their own words
ISO 9001:2026 Transition Readiness
- ISO 9001:2026 replaced the 2015 edition in September 2026 — certificates against :2015 stay valid through a three-year transition, and the ten-clause structure is unchanged, so the work is a delta, not a rebuild
- Each tenant states its own edition — 2015, transitioning, or 2026 — because which clause set you are audited against is your decision and your certification body's, not a platform default
- A structured home for the clauses a Stage 1 audit opens with: context and its climate-change determination (cl. 4.1), interested parties and which of their requirements the QMS addresses (cl. 4.2), scope (cl. 4.3), policy (cl. 5.2), and measurable objectives (cl. 6.2)
- Risk and opportunity run as two streams in one register, and their cl. 6.1.2 and cl. 6.1.3 effectiveness figures reach management review as separate items — a single blended number evaluates neither clause
- A 25-check readiness assessment over your own live records returns two scores that are never blended: overall readiness, and readiness on just the clauses that changed in :2026 — which is what a transition audit actually looks at
- An exportable evidence matrix — clause, what the standard asks to be retained, the record that answers it, where it lives, and whether you hold one — stating where evidence sits without assessing its adequacy, so your certification body forms its own view
Offline Field Data Capture
- Inspectors, samplers, and field technicians keep working with no connection — assignments, records, photographs, and signatures captured on the device
- Every record carries its own device-reported capture time, kept separate from when the server received it, so the gap between the work and the sync is visible rather than quietly closed
- A sync conflict is resolved by a person, never silently overwritten — two accounts of the same record are a disagreement to settle, not a last-write-wins race
- Quality-checking a field record is separated from capturing it, enforced as a duty conflict rather than left to procedure
- Cross-vertical: the same capture surface serves construction site sampling, inspection-body field work, and environmental sampling
Certified Document Translation
- A translation is a separate, watermarked derivative — it never replaces the issued document, never re-hashes it, and never writes back to the source record
- Identifiers, measured values, units, dates, standard references, and verdict fields are reproduced exactly and are never sent for translation: a localised clause number is a data error wearing a translation's clothes
- A translated certificate or COA carries a TRANSLATION — NOT THE CERTIFIED RECORD watermark and the source document's own integrity hash
- Latin-script languages render through the standard document pipeline; Arabic, Hebrew, CJK, Cyrillic, Greek, Thai, and Indic scripts route to a renderer that shapes and orders them correctly
- Every rendered translation states that the English original is the authoritative record and prevails in any discrepancy
Job Workspace
- One piece of work normally lives across four records — the request, the accepted tender, the chain-of-custody record, and the certificate — each on its own screen
- The workspace reads all four as one job and computes the stage and the single thing blocking it, in the order the work actually has to happen
- Nothing it shows is stored: a saved "current stage" is a second source of truth that drifts from the records it claims to summarise
- A contract signature is re-verified against its own terms on every read, so the workspace never shows a green check over an agreement that no longer matches what was signed
- Read-only by design — every action links out to the record that owns it, so there is one place a certificate can be issued, not two
EU AI Act Compliance (Articles 9–17)
- Automated assessment maps 9 EU AI Act articles to existing AILS controls — no manual evidence gathering
- Article 14 (Human Oversight): re-auth on COA signing, manager override with re-auth, RBAC-enforced issuance gate
- Article 17 (QMS): full quality management system — CAPA, audits, deviations, training, risk, proficiency testing
- Article 15 (Cybersecurity): application-level encryption, multi-factor authentication, 1232 automated tests with adversarial pen-test scenarios
- AI Act Compliance Advisor agent answers compliance questions based on your specific assessment results
- Download a regulator-ready PDF gap report to hand to an auditor or a supervisory authority
Agent Self-Reporting Loop — Always-On Health Monitoring
AILS watches itself 24/7. When something needs attention, it tells you what it found, what it recommends, and waits for your approval.
Agent Runtime Self-Reporting
Agents detect their own failures or poor output in production and file a ticket — after a hardcoded safety-boundary check (protected paths & security keywords never enter the auto-fix pipeline).
→System Test Suite Integration
Automated health tests catch issues before users do. Runtime failures and test failures share one pipeline.
→AI Code Analysis → Diagnosis
Medium-severity tickets trigger AI analysis of the failing route: root cause, proposed unified-diff fix, blast-radius and risk assessment.
→Human Approval Gate
Mandatory. AI proposes, humans decide, architecture enforces. Approve, reject, or request revision — with one-click rollback available.
→AI Health Report Integration
Agent health flows into the system-test report — distinguishing infrastructure issues from single-agent prompt/parsing issues.
Key insight: test failures and runtime failures share one pipeline — every failure is caught, diagnosed, and human-approved before any fix deploys.
Five interlocking systems: agent runtime self-reporting → system test suite → AI code analysis & diagnosis → mandatory human approval gate → AI health report integration. Every failure is caught, diagnosed, and human-approved before any fix is deployed.
112 purpose-built AI agents
Not a generic chatbot layer. 112 specialized agents with deep operational context, embedded in every module — with full per-tenant data scoping.
All 112 agents are scoped to the tenant's live data — fully private, no cross-tenant access.
Enterprise integrations
Bidirectional connections to the systems your enterprise already runs — no middleware, no implementation project, no consultant required.
Native SAP Quality Management bridge
Direct SAP QM interoperability — COA results out, inspection lots in, no middleware. AILS pushes finished COA results into SAP inspection lots and pulls new inspection lot requests from SAP to create COCs automatically — closing the loop between your lab and your enterprise ERP without a middleware layer.
- Bidirectional sync — COA results out, inspection lots in
- AI-guided setup agent with live connection testing
- No middleware, no ETL pipeline, no implementation project
- Full audit trail on every push and pull event
CRM sync — connect lab ops to your sales pipeline
Link your lab workflow directly to Salesforce. Push quotes, COA certificates, and results to contacts and opportunities — keeping your CRM and lab data aligned without manual re-entry.
- Push COA certificates and results to Salesforce contacts
- Sync quotes and proposals to Salesforce opportunities
- Browse your Salesforce product catalogue from within AILS
- AI-guided OAuth connection setup
EMR integration — HL7 FHIR R4
HL7 FHIR R4 connector for clinical labs. Inbound orders and outbound results over FHIR, AI-assisted field mapping, and a sync-log agent that monitors every transaction and surfaces issues before they become compliance events.
- Inbound order / outbound result sync via HL7 FHIR R4
- Works with FHIR-compatible EMRs (Epic, Cerner, Meditech)
- AI field mapping agent — no manual schema work
- Sync log review and troubleshooting via agentic tool loop
What would it cost to build this from scratch?
Building a multi-tenant regulated operations platform with this level of compliance architecture, AI integration, and test coverage from scratch takes years and a full engineering team. The platform is built. The compliance is baked in. The AI layer is running. What's left is putting it in the right hands.
See the infrastructure live.
Screen recordings. Real compliance workflows. Every vertical covered.