Pharmaceutical and life-sciences companies run validated GxP systems, GxP being shorthand for the good-practice regulations that cover manufacturing and laboratories. Those systems include laboratory information management (LIMS), manufacturing execution (MES), quality management (QMS) and the manufacturing controls around them. Under 21 CFR Part 11, WHO-GMP and Schedule M, data integrity and complete, attributable audit trails are a condition of the licence to operate. Staff, contract manufacturers and equipment vendors all work on these systems, and each person's access has to be unique, controlled and fully logged.
What ALCOA+ means for an access record
ALCOA+ is the data-integrity shorthand used by regulators and quality teams. A record should be attributable, legible, contemporaneous, original and accurate, and the plus adds complete, consistent, enduring and available. Inspectors expect these principles to hold for every privileged action. Several of them apply directly to the records Tanflow keeps.
- An action is attributable when it is tied to one named person. Every action on a validated system goes through a unique identity, and there are no shared logins on LIMS, MES or QMS.
- A contemporaneous record is written at the time of the event. Every login, grant, session and command goes into Tanflow's append-only audit store as it happens.
- Complete, original evidence comes from recording the session itself. Terminal sessions are captured as searchable text and replayable video, and graphical sessions as video with metadata.
- Enduring and available records last as long as retention policy says and can be produced on request. Replays and reports can be exported for an inspection.
One identity per person, from hiring to exit
The IAM Suite keeps employees, contractors, partners and service accounts in one directory that follows the HR record. A new analyst gets birthright access on day one, a role change recalculates entitlements and removes the old ones, and a leaver is disabled on every connected system when HR records the exit. Contract manufacturer and vendor identities can carry an end date. Single sign-on with multi-factor authentication puts one strong login in front of the applications.
Administrative access to GxP databases and application servers
Tanflow PAM vaults the administrative credentials for GxP databases and application servers in AES-256 encrypted storage and injects them into gateway sessions. The administrator works under their own name, never sees the password, and the session is recorded against them. An on-screen watermark with the user's name and the time discourages credential sharing and photographing the screen. Only the Super Admin tier can reveal a stored credential, after an MFA step-up, and each reveal is audited.
Command control checks each terminal and SQL command as it is entered. A policy can block DROP and TRUNCATE on a production GxP database, and sensitive commands can wait for the user to type a reason, which is stored next to the command. Emergency access uses sealed break-glass credentials that need several approvers and are followed by a mandatory review.
A LIMS vendor patch under change control
Equipment and software vendors work in time-boxed, scoped and recorded sessions and hold no standing accounts. Take a LIMS vendor who needs database access to apply a validated patch. QA grants a time-boxed JIT window tied to the change control, and the request names the target connections, the people covered and the window. The vendor connects through the browser gateway under a named identity, with credentials they never see. QA can follow the work through a read-only share link that blocks all input.
Changes to controlled data are recorded, destructive operations are blocked, and the session closes with the window. Sessions during the window are tracked against the change request. When the auditor asks for the data-integrity trail on that change, QA opens the request and plays back the recording.
Where the records live and who can read them
Recordings and logs are written append-only with integrity checks, and there is no administrative route to edit or delete evidence without a trace. Access to the audit store is itself logged. An auditor can be given a scoped, read-only role to search logs and watch replays for the period of their engagement. Periodic certification campaigns send each person's access to validated systems to the system owner, who certifies or revokes it on the record. Replays and access-review reports can be exported for regulatory audits and for customer audits.
Where Tanflow's trail stops and the application's begins
Tanflow records who reached a validated system, under which approval, and what they did in a privileged session. The record-level audit trail inside LIMS, MES or QMS belongs to that application and its own validation. Tanflow is designed to align with the access-control expectations of 21 CFR Part 11, WHO-GMP and Schedule M, and gives evidence for GAMP 5, ISO 27001 and DPDP Act 2023 reviews. In an inspection the two trails are read together: the application shows that a value changed, and the Tanflow recording shows the named person, the approved change request and every command in the session that changed it.