Quilt Data Platform · For regulated pharma R&D
21 CFR Part 11 controls for S3-backed pharma data
Validation documentation, tamper-evident audit trails, and signature-ready workflows for electronic records that live on Amazon S3. Runs inside your AWS account, on the data you already have.
Part 11 is a property of how a system is operated, not a vendor sticker.
No AWS service or data platform is "21 CFR Part 11 certified" on its own. Compliance is established by how the records system is configured, documented, and operated over time. The Quilt Data Platform exists to make that posture practical on Amazon S3, with the right primitives in the right places, the validation documentation a QA team can use as a starting point, and workflow controls that hold up under inspection.
Validation documentation
URS, FS, DS, IQ, OQ, PQ templates aligned to a Quilt deployment, plus risk assessment and SOP scaffolds. Practical starting points for a real Part 11 effort.
Tamper-evident audit trails
Every package revision is cryptographically hashed. Every registration, metadata change, and release-state transition is logged with attribution. Exportable to PDF or CSV for any inspection scope.
Signature-ready workflows
Workflow contracts that require signer identity, MFA-verified authentication, UTC timestamp, and explicit meaning of signature, all bound to the cryptographic hash of the record.
Runs in your AWS account
Quilt deploys into your VPC, under your IAM and KMS, using your S3 buckets. CloudTrail, Config, and Object Lock stay under your control. Data does not leave your environment.
How Quilt maps to Part 11
A plain-English mapping of Part 11 requirements to the Quilt-plus-AWS controls that satisfy them. A starting point for the conversation with your QA team.
| Part 11 requirement | How Quilt plus AWS satisfies it |
|---|---|
| Validation of the system | Quilt validation pack: URS, FS, DS, IQ, OQ, PQ templates and risk assessment scoped to your deployment. |
| Accurate, complete, human-readable record copies | Quilt Web Catalog renders every package with README, manifest, and previews. PDF and CSV export. |
| Records protection during retention | S3 Versioning, Object Lock, KMS, and cross-region replication on every registry bucket. |
| Access limited to authorized individuals | SSO-integrated catalog permissions, role-based workflow transitions, scoped IAM for service writes. |
| Time-stamped audit trails with prior information preserved | Package events plus CloudTrail plus S3 versioning. UTC timestamps. Immutable history per package. |
| Operational checks and permitted sequencing | Quilt workflow contracts: required files, required metadata, role-gated state transitions. |
| Electronic signatures with identity, time, meaning | Signature events bound to the package hash, with MFA-verified signer identity, UTC timestamp, and an explicit meaning-of-signature string. |
A starting point, not a substitute for the formal mapping your QA team will produce.
What a deployment includes
A Quilt deployment for regulated pharma data is a working system, configured to your records definition, with the artifacts your QA team needs.
Software
Quilt Web Catalog and the quilt3 Python client deployed into your AWS account. Object Lock on registry buckets. MCP server for AI-agent access under the same controls.
Workflows
Configurable workflow contracts for your regulated records: required files, required metadata, role-bound state transitions, signature requirements.
Documentation
URS, FS, DS, IQ, OQ, PQ templates pre-aligned to a Quilt deployment, with an SOP scaffold for registration, signing, and release.
Working sessions
Direct sessions with the Quilt team to define your records model, map controls, and run a mock inspection against the live system.
Questions teams ask before deploying
"S3 Object Lock is already on. Is that enough?"
Object Lock makes objects immutable. It does not make records identifiable, attributable, or inspectable as units. Inspectors ask for revision 3 of a regulated dataset and proof that it has not changed since it was signed. Quilt provides that answer. Object Lock is the storage primitive beneath it.
"We have an ELN or LIMS. Where does Quilt fit?"
ELNs and LIMS govern lab observations and sample tracking. They do not govern the multi-gigabyte data outputs from sequencers, microscopes, and pipelines. Quilt is the records system for that data. It integrates with Benchling and similar systems rather than replacing them.
"We aren't under Part 11 yet. Does this matter today?"
Retrofitting governance onto an existing system is reliably more expensive than building on a substrate that already supports it. Teams who have been through their first Part 11 audit consistently report that they would have moved earlier.
Walk through a Part 11 posture for your data
Bring three of your regulated datasets to a working session. We'll show what they look like as Quilt Packages, where the Part 11 gaps are today, and what the next ninety days could look like.