labs@atheron:~/industries/pharma/compliance$ audit --controls --evidence

Pharma compliance

Validated, audit-ready software for the life sciences.

Software used in GxP work has to be validated, and electronic records and signatures have to hold up to inspection. We build with that in mind from the first sprint: audit trails, controlled changes, signatures that mean something, and the validation documentation your quality team approves.

Start a project See the example projects

// what matters here

What is different in this industry.

Audit trails that hold up

Every create, change and delete recorded with who, when and why, in a trail users cannot alter.

Electronic signatures

Signatures bound to their records, with the meaning of each signature stated, following 21 CFR Part 11 practices your quality team sets.

Validation documentation

Requirements, risk assessment, test protocols and traceability delivered with the software; your quality team approves them.

Participant data protected

Trial participants' health data handled with HIPAA-ready architecture and the privacy laws of each country in the trial.

// example projects

Priced examples for this service.

Each one is hypothetical, labelled as such, and priced live from our rate card. Open any of them in the estimator and make it yours.

Example projectWeb appMobile app

Trial participant diary app

Hypothetical. Not a client, not a result.

// The problem

A sponsor running a multi-site trial collects symptom diaries on paper, filled in late or all at once, and site staff transcribe them into the EDC.

// What we would build

An iOS and Android diary app with reminders at the right time of day, a site portal for coordinators, and a data export to the EDC, with the audit trail and electronic signatures 21 CFR Part 11 and ICH GCP expect.

// What is in it

Diary entries timestamped on the device, with late entries clearly marked
Reminders on the participant's own schedule, in their language
A site portal where coordinators see compliance and follow up
Audit trail of every entry and change, with reason for change
Data export to the sponsor's EDC on an agreed schedule
Validation package: requirements, test scripts and traceability matrix

// Stack

React Native
Next.js
PostgreSQL
EDC export interface
AWS (Canada region)

// estimate

Build: ≈ US$167,000 to US$255,000, delivered within 37 weeksCAD 237,200 to 362,900
Hosting: ≈ US$492 a monthCAD 700 a month
Support: ≈ US$5,010 a monthCAD 7,135 a month

Prices in your currency are estimates from today's Bank of Canada rate. All invoicing is in CAD or USD.

Timeline by milestone

Discovery: 2.9 to 3.4 weeks
Design approved: 6.4 to 11.4 weeks
Core features: 1.9 to 2.9 weeks
Full build: 1.4 to 1.9 weeks
First build on devices: 3.4 to 5.9 weeks
Testing and fixes: 0.4 to 0.9 weeks
Store submission: 0.4 to 0.9 weeks
Validation package delivered: 0.9 to 1.4 weeks
Controls built and evidenced: 0.4 to 0.9 weeks
Readiness review: 0.4 to 8.4 weeks
Launch: 0.9 to 1.4 weeks

Outside our hands, and added to the calendar

App store review: 1 week
Vendor test environment access: 1 to 4 weeks
Business associate agreements with your vendors (HIPAA): 2 to 6 weeks
Booking a penetration tester and their report: 2 to 4 weeks

How it is paid

Deposit 20%: CAD 47,440 to 72,580
Discovery 5.9%: CAD 13,994.80 to 21,411.10
Design approved 5.9%: CAD 13,994.80 to 21,411.10
Core features 4.8%: CAD 11,385.60 to 17,419.20
Full build 3.2%: CAD 7,590.40 to 11,612.80
First build on devices 12.8%: CAD 30,361.60 to 46,451.20
Testing and fixes 1.6%: CAD 3,795.20 to 5,806.40
Store submission 4.2%: CAD 9,962.40 to 15,241.80
Validation package delivered 12.7%: CAD 30,124.40 to 46,088.30
Controls built and evidenced 6.3%: CAD 14,943.60 to 22,862.70
Readiness review 6.3%: CAD 14,943.60 to 22,862.70
Launch 6.3%: CAD 14,943.60 to 22,862.70
Holdback, 30 days after launch (10%): CAD 23,720 to 36,290

Start from this example

Example projectWeb appAICustom LLM

Safety case intake model

Hypothetical. Not a client, not a result.

// The problem

A pharmacovigilance team reads every incoming adverse event report by hand to find the product, the event, the patient details and the reporting clock.

// What we would build

A custom model, further trained on medical and safety literature and then on the team's own de-identified cases, that reads each report and proposes the case fields and MedDRA terms, which a safety specialist then checks, running on a GPU server inside the company.

// What is in it

Reports from email, web forms and call notes read into case fields
Suggested MedDRA terms with the passage they came from
Seriousness and reporting deadline flagged for a specialist to check
A model trained further on safety language, then on your cases
Scored against a held-out set of your cases before every release

// Stack

Open-weight base model, further trained
PyTorch
Python
Next.js
Lenovo GPU server on site

// estimate

Build: ≈ US$269,000 to US$407,000, delivered within 55 weeksCAD 382,400 to 579,600
Hosting: ≈ US$176 a monthCAD 250 a month
Support: ≈ US$2,500 a monthCAD 3,565 a month
Hardware: ≈ US$47,800 to US$197,000CAD 68,000 to 280,800

Prices in your currency are estimates from today's Bank of Canada rate. All invoicing is in CAD or USD.

AI route: Custom LLM
Model running cost: ≈ US$176 a monthCAD 250 a month

Timeline by milestone

Discovery: 2.9 to 3.4 weeks
Data and evaluation plan: 0.4 weeks
Design approved: 2.9 to 4.9 weeks
Core features: 2.4 to 3.9 weeks
Full build: 1.4 to 2.9 weeks
Training: 16.4 to 28.4 weeks
Testing and fixes: 0.4 weeks
Evaluation and red-teaming: 3.9 to 4.4 weeks
Validation package delivered: 3.9 to 4.4 weeks
Launch: 0.9 to 1.4 weeks
Production: 0.9 to 1.4 weeks

Outside our hands, and added to the calendar

Hardware delivery, after it is ordered: 2 to 6 weeks
Vendor test environment access: 1 to 4 weeks

How it is paid

Deposit 20%: CAD 74,980 to 114,420
Discovery 0.7%: CAD 2,624.30 to 4,004.70
Data and evaluation plan 6.8%: CAD 25,493.20 to 38,902.80
Design approved 0.7%: CAD 2,624.30 to 4,004.70
Core features 2.2%: CAD 8,247.80 to 12,586.20
Full build 1.4%: CAD 5,248.60 to 8,009.40
Training 20.4%: CAD 76,479.60 to 116,708.40
Testing and fixes 0.7%: CAD 2,624.30 to 4,004.70
Evaluation and red-teaming 13.6%: CAD 50,986.40 to 77,805.60
Validation package delivered 15.5%: CAD 58,109.50 to 88,675.50
Launch 0.7%: CAD 2,624.30 to 4,004.70
Production 7.3%: CAD 27,367.70 to 41,763.30
Holdback, 30 days after launch (10%): CAD 37,490 to 57,210
GPU time for training and testing, at cost: CAD 7,500. Billed up front, at cost, outside the milestones
GPU server for AI, for the model: CAD 68,000 to 280,800. Billed up front, at cost, outside the milestones

Start from this example

// questions

Questions we get about this.

Will you validate the system for us?

We provide the validation package and execute the tests with you; your quality unit approves the validation, as your procedures require.

Is the software Part 11 compliant?

Compliance is a property of how the system is used under your procedures. We build the technical controls Part 11 expects and document them.

Can changes be made after validation?

Yes, through change control: each change is assessed, tested and documented so the system stays validated.

Back to the industry: Pharma and life sciences About the service: Compliance and security engineering

// next

Not quite your project?

Tell us what you have in mind. We will come back to you with a range and the questions that would narrow it. Or book a call and talk it through.

Start a project Book a call