Data integrity software for GxP labs: five products read against ALCOA and the audit trail rule
Published , reviewed
Verdict
- Best overall
- CFR GatewayBuilt for the instruments a lab already owns: it wraps their software with a login, role-based access, a timestamped trail and central server storage. Its own product page describes the timestamped audit trail and role-based access (2 of 10 rows verified, the most in this lineup). It also names EU Annex 11.
- Best for a biopharma data platform
- Tetra Scientific Data and AI CloudFor biopharma teams centralizing instrument data across R&D and QC. The only product here whose own pages describe validation documentation for customers, in a GxP package with a separate test environment. Its signature and audit trail rows are claims we did not check.
- Best for audit trail review
- Easy-Up Audit Trail Review (GxP Data Integrity)The one product in this lineup built for the review itself: it collects analytical and audit trail data from instruments and systems, compares them and records evidence of the checks. None of its Part 11 rows is described on its own pages, so see the review workflow in a demo before you rely on it.
Fig. 01In a regulated lab, data integrity software is what keeps an instrument's result attributable, original and unaltered from the moment it is created to the end of its retention period. Four kinds of product do that work: they capture data at the instrument, keep the raw files in one archive, watch them for change, and help QA review the audit trail. We read what five products publish on their own pages and set them against ALCOA (FDA, 2018), ALCOA+ (PIC/S, 2021) and the audit trail rule in § 11.10(e).
Scope
This page is about regulated lab data under GxP, not the data-pipeline, data-quality or observability tools that data engineering teams also call data integrity software.
New to the attributes? The ALCOA+ principles guide explains each one before you compare products against them.
Four jobs data integrity software does
Vendors sell platforms; a lab buys a job done. Name the job first, then read only the products built for it. Each job below lists the attributes it protects, the rule lines behind it and the demo test that proves it.
Capture data where the instrument creates it
The result goes from the instrument into a controlled store under the analyst's own login, with no one retyping it and no copy left on a local drive.
Carries: Attributable (ALCOA, FDA 2018), Contemporaneous (ALCOA, FDA 2018), Original (ALCOA, FDA 2018), Consistent (+, PIC/S 2021)
- § 11.10(e)
- A trail that records the date and time of operator entries and actions that create, modify, or delete records.
- § 11.10(d), (g)
- Access limited to authorized people; authority checks on who may use the system or alter a record.
- FDA 2018 Q&A, Q12
- Recording data on paper that is thrown away after transcription is “not acceptable”.
Built for this job in this comparison
- CFR Gateway: Wraps existing instrument software with a login, role-based access, a timestamped audit trail and central server storage.
- Scitara DLX: Moves, transforms and tracks data between instruments, applications and repositories.
- Tetra Scientific Data and AI Cloud: Collects and harmonizes scientific data from lab instruments and applications.
- LabVantage SDMS: Captures instrument files, encrypts them and stores them in a repository.
Ask for it in the demo: Run a sample and follow the result from the instrument to the stored record with nobody typing it. Then open the trail entry: who, which instrument, what time.
Support the audit trail review
Before a result is released, someone reads the changes made to it. The software gathers those trail entries next to the data and keeps evidence that the review happened.
Carries: Accurate (ALCOA, FDA 2018), Complete (+, PIC/S 2021)
- § 11.10(e)
- Requires the trail and its retention. It sets no review schedule.
- FDA 2018 Q&A, Q7
- Record reviewers “should review the audit trails that capture changes to data associated with the record”.
- Annex 11 § 9
- Audit trails need to be available, convertible to a generally intelligible form and “regularly reviewed”.
Built for this job in this comparison
- Easy-Up Audit Trail Review (GxP Data Integrity): Collects analytical data and audit trail data from instruments and systems, compares them for review and records evidence of the checks.
Ask for it in the demo: Pick one released result and show its trail in the reviewer's view: which entries the tool puts first, how a reviewer records the outcome, and what that record looks like a year later.
Keep the original record in one archive (SDMS)
Raw instrument files, with their metadata, are kept in a central store that outlives the instrument PC, in a form the software can still open and reprocess.
Carries: Original (ALCOA, FDA 2018), Legible (ALCOA, FDA 2018), Enduring (+, PIC/S 2021), Available (+, PIC/S 2021)
- § 11.10(b)
- Accurate and complete copies, human readable and electronic, for inspection.
- § 11.10(c)
- Records protected for accurate and ready retrieval throughout the retention period.
- FDA 2018 Q&A, Q10
- A static printout of dynamic data, such as an FT-IR spectral file, does not satisfy the rule to keep originals or true copies.
Built for this job in this comparison
- LabVantage SDMS: Captures instrument files and stores them, encrypted, in a repository.
- CFR Gateway: Saves the wrapped instruments' data to central server storage.
- Tetra Scientific Data and AI Cloud: Built for centralizing instrument data across R&D and QC.
Ask for it in the demo: Restore a raw file from the archive, open it in the instrument software and reprocess it. Show the metadata that came back with it.
Watch the data for change, at rest and in motion
The software can tell when a stored file or a record in transit has changed, and keeps a record of every hand-off between systems.
Carries: Accurate (ALCOA, FDA 2018), Complete (+, PIC/S 2021), Original (ALCOA, FDA 2018)
- § 11.10(a)
- Validation includes “the ability to discern invalid or altered records”.
- § 11.10(e)
- “Record changes shall not obscure previously recorded information.”
- FDA 2018 Q&A, Q12
- Data “cannot be modified without a record of the modification”.
Built for this job in this comparison
- LabVantage SDMS: Checks a hash each time a stored file is accessed, to confirm it has not changed.
- Scitara DLX: Its audit trail records logins, actions and configuration changes, and an event stream logs each data exchange.
Ask for it in the demo: Change a stored file outside the software, then show us what flags it, who is told, and where that event is recorded.
Which job does your lab need?
Most labs do not need all four. Mark what is true today and the panel lists the jobs, the attributes at risk and the products here built for each. Copy the list into your user requirements or your next vendor call.
Mark what is true in your lab. Pre-filled with a typical small QC lab.
noAnalysts copy balance or pH readings onto a worksheet by hand
yesInstrument PCs run under one shared login
noResults are saved to the instrument PC's local drive
yesWe keep PDF printouts of chromatograms or spectra, not the raw files
yesNobody opens the instrument audit trail before a result is released
noData moves between instruments, LIMS and reports by export and re-import
noWe could not prove a stored raw file is the one the instrument wrote
noOld results sit on a retired instrument PC
Your gap list
3 jobs to cover
At risk: Attributable (ALCOA, FDA 2018), Original (ALCOA, FDA 2018), Accurate (ALCOA, FDA 2018), Complete (+, PIC/S 2021)
01Capture data where the instrument creates it
- § 11.10(e)
- A trail that records the date and time of operator entries and actions that create, modify, or delete records.
- § 11.10(d), (g)
- Access limited to authorized people; authority checks on who may use the system or alter a record.
- FDA 2018 Q&A, Q12
- Recording data on paper that is thrown away after transcription is “not acceptable”.
Built for it here: CFR Gateway, Scitara DLX, Tetra Scientific Data and AI Cloud, LabVantage SDMS
Ask the vendor: Run a sample and follow the result from the instrument to the stored record with nobody typing it. Then open the trail entry: who, which instrument, what time.
02Support the audit trail review
- § 11.10(e)
- Requires the trail and its retention. It sets no review schedule.
- FDA 2018 Q&A, Q7
- Record reviewers “should review the audit trails that capture changes to data associated with the record”.
- Annex 11 § 9
- Audit trails need to be available, convertible to a generally intelligible form and “regularly reviewed”.
Built for it here: Easy-Up Audit Trail Review (GxP Data Integrity)
Ask the vendor: Pick one released result and show its trail in the reviewer's view: which entries the tool puts first, how a reviewer records the outcome, and what that record looks like a year later.
03Keep the original record in one archive (SDMS)
- § 11.10(b)
- Accurate and complete copies, human readable and electronic, for inspection.
- § 11.10(c)
- Records protected for accurate and ready retrieval throughout the retention period.
- FDA 2018 Q&A, Q10
- A static printout of dynamic data, such as an FT-IR spectral file, does not satisfy the rule to keep originals or true copies.
Built for it here: LabVantage SDMS, CFR Gateway, Tetra Scientific Data and AI Cloud
Ask the vendor: Restore a raw file from the archive, open it in the instrument software and reprocess it. Show the metadata that came back with it.
ALCOA, ALCOA+ and what software carries
FDA's 2018 Q&A defines data integrity as “the completeness, consistency, and accuracy of data” and names five attributes (ALCOA). PIC/S PI 041-1 (2021) lists four more (complete, consistent, enduring, available). No product delivers any of them alone: each attribute is part software and part how the lab works.
Scroll sideways for all columns
| Attribute | What it means | Software job that carries it | What stays with you |
|---|---|---|---|
| AttributableALCOA, FDA 2018 | Who or what performed the task, and when, including changes. | One login per person, never shared. Software can demand a login; it cannot stop a password being passed round. | |
| LegibleALCOA, FDA 2018 | Readable and unambiguous. | Handwritten entries, and what your codes and abbreviations mean. | |
| ContemporaneousALCOA, FDA 2018 | Recorded as it takes place. | A procedure that manual observations are entered at the time, not later. | |
| OriginalALCOA, FDA 2018 | The first capture; dynamic data stays dynamic. | Deciding, per instrument, which record is the original: the slip from a balance, the file from an FT-IR. | |
| AccurateALCOA, FDA 2018 | A truthful representation of the facts. | Calibration, and the second-person review of every result. | |
| Complete+, PIC/S 2021 | Nothing lost or deleted, metadata included. | Investigating aborted and incomplete runs instead of discarding them. | |
| Consistent+, PIC/S 2021 | A defined consistency in dates, units and rounding. | One date, unit and rounding convention, written into your SOPs. | |
| Enduring+, PIC/S 2021 | Intact and accessible for the retention period. | The retention period itself, which the predicate rule sets, not Part 11. | |
| Available+, PIC/S 2021 | Reviewable at any time in the retention period. | Proving you can still retrieve and read old records after an upgrade or migration. |
Meanings in short from PIC/S PI 041-1 (2021). The job column is our reading of where software helps most; it is not a regulator's mapping.
Common misreading
“ALCOA+ is FDA's standard” is a common misreading. FDA's Q&A says ALCOA; the four added attributes are listed in PIC/S PI 041-1 (2021). When a vendor credits FDA with ALCOA+, ask which document it is reading.
Takeaway
Test one real record against all nine before you shop: the ALCOA+ record check shows which attributes fail and whether the fix is a tool or a procedure.
The Part 11 rows, product by product
The rows that carry this category come first: the trail, its retention, copies and access. Signature rows sit last because most of these products are not where a record gets signed. Two of the five describe the audit trail on their own pages; the others claim it.
Scroll sideways for all vendors
| Requirement | CFR Gateway | Scitara DLX | Tetra Scientific Data and AI Cloud | LabVantage SDMS | Easy-Up Audit Trail Review (GxP Data Integrity) |
|---|---|---|---|---|---|
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verified | verified | stated | stated | stated |
| Audit trail kept as long as the record§ 11.10(e) | stated | stated | stated | not stated | stated |
| Accurate, complete copies for inspection§ 11.10(b) | stated | stated | stated | verified | stated |
| Access and authority checks by role§ 11.10(d), (g) | verified | stated | stated | stated | stated |
| Validation documentation to support the customer's own validation§ 11.10(a) | not stated | not stated | verified | not stated | not stated |
| EU Annex 11 statementEU GMP Annex 11 | stated | not stated | stated | not stated | not stated |
| Open-system controls: encryption, digital signatures§ 11.30 | not stated | not stated | not stated | stated | not stated |
| Signature shows name, date and time, and meaning§ 11.50 | stated | stated | stated | not stated | stated |
| Signature linked to its record so it cannot be moved§ 11.70 | stated | stated | stated | not stated | stated |
| Two distinct components to sign§ 11.200(a) | stated | stated | stated | not stated | stated |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Several of these products run as cloud platforms, which raises the question of who controls access to the records; Part 11 for cloud and SaaS systems covers it. Whatever a vendor documents, validating the system for your use is yours under § 11.10(a); see computer system validation for small labs.
Audit trail review: what is actually required
Vendors often sell audit trail review as a Part 11 requirement. It is not one. § 11.10(e) requires a secure, computer-generated, time-stamped trail that records who created, changed or deleted a record and when, and says “Record changes shall not obscure previously recorded information.” The duty to read that trail comes from the predicate rules and the guidance on them.
| Source | What it says | Review duty |
|---|---|---|
| 21 CFR 11.10(e) | The trail must exist, be secure and time-stamped, never obscure old values, and be kept as long as the record. | Sets no review duty or schedule. |
| FDA 2018 Q&A, Q7 | Whoever reviews a CGMP record reviews the audit trail that captures changes to it, with the rest of the record. | Same reviewer, same time as the data. |
| FDA 2018 Q&A, Q8 | Use the CGMP review frequency where one is set (each significant step, § 211.188(b); before batch release, § 211.22). | Otherwise risk-based, using process knowledge. |
| Annex 11 § 9 | The reason for a change or deletion of GMP-relevant data is documented; trails are available and intelligible. | “Regularly reviewed”. |
FDA puts it plainly: “Audit trail review is similar to assessing cross-outs on paper when reviewing data.” Where no frequency is set, FDA gives examples of trails suited to a risk-based schedule: “instrument operational status, instrument communication logs, and alert records.” The Q&A is written for drug CGMP; a GLP or device lab takes its review duties from its own predicate rule, and the Annex 11 and Part 11 mapping shows where the EU text asks more.
Software helps in two places: putting the trail entries that touch a result next to the result, so the reviewer is not paging through every login, and keeping a record that the review happened. It cannot decide whether a change was justified. Our guide to GxP audit trails covers what a good trail entry shows.
Inspection risk
FDA expects chromatographic data saved after each injection, not at the end of a set, and says “Aborted or incomplete injections should be captured in audit trails and should be investigated and justified.” A review that only looks at reported results will not see them.
Takeaway
Write down, per system, which trail entries are read, by whom and when, before you buy a review tool. The audit trail review checklist builds that list for one system at a time.
Printouts, true copies and the archive
The archive job exists because of one distinction in FDA's 2018 Q&A: static and dynamic records. A static record is “a fixed-data record such as a paper record or an electronic image”; a dynamic one lets the user interact with the content. A balance or pH meter may print a slip that is itself the original record, and that slip, or a true copy, is what you keep.
A chromatogram or a spectrum is different. FDA's example is the FT-IR spectral file, which “is dynamic and can be reprocessed”, so “a static record or printout is fixed and would not satisfy CGMP requirements to retain original records or true copies.” If the full spectrum is not on the printout, FDA adds, contaminants may be excluded. Keeping the PDF and deleting the raw file loses the original.
Fails the rule
Printing the chromatogram, signing the printout and clearing the instrument PC's data folder to free space. The printout is not a true copy of a dynamic record.
Electronic copies can stand in for originals when they preserve “the content and meaning of the original record”, including the metadata needed to reconstruct the activity and its static or dynamic nature. That is the test an SDMS has to pass, and it matches what Part 11 asks: accurate and complete copies for inspection under § 11.10(b), and records protected for “accurate and ready retrieval throughout the records retention period” under § 11.10(c).
Takeaway
For each instrument, write down which record is the original: the printout or the file. Where it is the file, the archive must keep it reprocessable for the full retention period, and your validation should show one restore.
Product by product
Each card shows the six rows that matter most for data integrity. Notes are the vendor's own caveats. For Easy-Up Audit Trail Review (GxP Data Integrity), no row is described on the vendor's own pages, so every status is a claim or a gap to close in a demo.
CFR Gateway
data integrity- What it is
- A compliance layer that loads at PC startup and wraps existing instrument software with a login, role-based access, a timestamped audit trail and central server storage. Agaram positions it for legacy instruments whose own software lacks Part 11 controls.
- Who it fits
- QC labs with older PC-controlled instruments they do not want to replace.
| Requirement | Status |
|---|---|
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verified |
| Audit trail kept as long as the record§ 11.10(e) | stated |
| Accurate, complete copies for inspection§ 11.10(b) | stated |
| Access and authority checks by role§ 11.10(d), (g) | verified |
| Validation documentation to support the customer's own validation§ 11.10(a) | not stated |
| EU Annex 11 statementEU GMP Annex 11 | stated |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on Agaram Technologies' own pages. Ask Agaram Technologies for its validation documentation and test the control in your own validation before you rely on it.
Agaram Technologies' own Part 11 pageread 2026-10-22
Scitara DLX
data integrity- What it is
- A cloud lab data exchange platform that moves, transforms and tracks data between instruments, applications and repositories. Its audit trail records user logins, actions and configuration changes, and an event stream logs each data exchange.
- Who it fits
- Labs connecting many instruments and systems that need a chain of custody for data in flight.
| Requirement | Status |
|---|---|
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | verified |
| Audit trail kept as long as the record§ 11.10(e) | stated |
| Accurate, complete copies for inspection§ 11.10(b) | stated |
| Access and authority checks by role§ 11.10(d), (g) | stated |
| Validation documentation to support the customer's own validation§ 11.10(a) | not stated |
| EU Annex 11 statementEU GMP Annex 11 | not stated |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on Scitara's own pages. Ask Scitara for its validation documentation and test the control in your own validation before you rely on it.
Scitara's own Part 11 pageread 2026-10-22
Tetra Scientific Data and AI Cloud
data integrity- What it is
- A cloud platform that collects and harmonizes scientific data from lab instruments and applications. TetraScience offers a GxP package with a separate test environment and verification and validation documentation for regulated use.
- Who it fits
- Biopharma companies centralizing instrument data across R&D and QC.
| Requirement | Status |
|---|---|
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | stated |
| Audit trail kept as long as the record§ 11.10(e) | stated |
| Accurate, complete copies for inspection§ 11.10(b) | stated |
| Access and authority checks by role§ 11.10(d), (g) | stated |
| Validation documentation to support the customer's own validation§ 11.10(a) | verified |
| EU Annex 11 statementEU GMP Annex 11 | stated |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on TetraScience's own pages. Ask TetraScience for its validation documentation and test the control in your own validation before you rely on it.
TetraScience's own Part 11 pageread 2026-10-22
LabVantage SDMS
data integrity- What it is
- The scientific data management system in the LabVantage platform, which captures instrument files, encrypts them and stores them in a repository. A hash is checked each time a file is accessed to confirm the stored copy has not changed.
- Who it fits
- Labs on LabVantage, or wanting an SDMS beside their LIMS, that need raw instrument data secured.
| Requirement | Status |
|---|---|
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | stated |
| Audit trail kept as long as the record§ 11.10(e) | not stated |
| Accurate, complete copies for inspection§ 11.10(b) | verified |
| Access and authority checks by role§ 11.10(d), (g) | stated |
| Validation documentation to support the customer's own validation§ 11.10(a) | not statedLabVantage's validation services page covers its LIMS, not the SDMS. |
| EU Annex 11 statementEU GMP Annex 11 | not stated |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on LabVantage Solutions' own pages. Ask LabVantage Solutions for its validation documentation and test the control in your own validation before you rely on it.
LabVantage Solutions' own Part 11 pageread 2026-10-22
Easy-Up Audit Trail Review (GxP Data Integrity)
data integrity- What it is
- An audit trail review tool that collects analytical data and audit trail data from lab instruments and systems and compares them for review. It records evidence of the checks performed and generates reports.
- Who it fits
- Pharma QC labs that must review instrument audit trails as a routine task.
| Requirement | Status |
|---|---|
| Secure, computer-generated, time-stamped audit trail§ 11.10(e) | stated |
| Audit trail kept as long as the record§ 11.10(e) | stated |
| Accurate, complete copies for inspection§ 11.10(b) | stated |
| Access and authority checks by role§ 11.10(d), (g) | stated |
| Validation documentation to support the customer's own validation§ 11.10(a) | not stated |
| EU Annex 11 statementEU GMP Annex 11 | not stated |
verified: read on the vendor's own documentation on 2026-10-22. stated: the vendor claims it; we did not check. not stated: nothing published.
Check with the vendor
Some rows above are stated or not stated on Orise's own pages. Ask Orise for its validation documentation and test the control in your own validation before you rely on it.
Orise's own Part 11 pageread 2026-10-22
How we read the vendors
Verdicts are editorial: no vendor can buy a verdict position or displace another vendor.
verified means we read the control described on the vendor's own documentation (help centre, validation pack page, compliance paper or trust page) on 2026-10-22. stated means the vendor claims it and we did not check it. not stated means the vendor publishes nothing on it.
FDA keeps no list of certified or approved Part 11 software. Compliance is a validation claim each regulated company makes for its own use of a system, so a vendor's Part 11 claim is where your validation starts, not where it ends.
Questions
Is there FDA-approved or certified data integrity software?
No. FDA keeps no list of certified or approved Part 11 software, and Part 11 binds the people who use a system, not the vendor. A vendor's “Part 11” or “ALCOA” claim means it states its product supports the controls. Your lab still validates the system for its own use under § 11.10(a).
Does Part 11 require us to review audit trails?
Not in those words. § 11.10(e) requires the trail, says changes must not obscure what was there, and keeps the trail as long as the record. The review comes from elsewhere: FDA's 2018 Q&A says people who review CGMP records should review the audit trails that capture changes to them, and Annex 11 § 9 says trails should be “regularly reviewed”. Our audit trail review checklist turns that into a routine.
Is ALCOA+ an FDA requirement?
FDA's 2018 Q&A names ALCOA: attributable, legible, contemporaneously recorded, original or a true copy, and accurate. The four added attributes (complete, consistent, enduring, available) are listed by PIC/S in PI 041-1, in force from 1 July 2021, not by FDA. Working to all nine as one checklist is sensible; when you cite them, credit each list to the body that wrote it. The ALCOA+ principles guide takes them one at a time.
Our LIMS and chromatography software already keep audit trails. Do we need a separate tool?
Often not. The products on this page fill the gaps a system's own trail leaves: older instruments whose software has no access control or trail, data that moves between systems, and reviewing trails from many systems at once. List your instruments and systems first. Where each one keeps its own records with a working trail, the job left may only be review. The LIMS comparison and the chromatography data system comparison read those systems against the same rows, and the Part 11 temperature monitoring comparison does the same for temperature and environmental monitoring.
Does a copy in an SDMS count as our backup?
It can, if it meets what FDA means by the word. For drug CGMP, a backup under § 211.68(b) is “a true copy of the original record that is maintained securely throughout the record retention period”, and temporary copies made in case of a crash do not count. A true copy has to preserve the content and meaning of the original, including the metadata needed to reconstruct the activity. Prove that in your validation: restore a file and reprocess it.
Can we keep only the final result after reprocessing a chromatogram?
No. FDA's answer is direct: if chromatography is reprocessed, written procedures must be followed and “each result retained for review”. Aborted or incomplete injections should be captured in the audit trail and investigated. A data integrity tool can keep every version; deciding which result is reported stays a documented, reviewed decision.
Sources
Regulation text from the eCFR and EudraLex; guidance from FDA and PIC/S. Vendor sources are linked on each product card. General information, not regulatory advice.
- 21 CFR Part 11, Electronic Records; Electronic Signatures, eCFRread 2026-10-22
- Data Integrity and Compliance With Drug CGMP: Questions and Answers (December 2018), FDAread 2026-10-22
- PI 041-1, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments (2021), PIC/Sread 2026-10-22
- EudraLex Volume 4, Annex 11: Computerised Systems (2011), European Commissionread 2026-10-22
- 21 CFR Part 211, CGMP for Finished Pharmaceuticals, eCFRread 2026-10-22