Security & data handling

Qualisera is not a model developer. Generating, reviewing and answering all use third-party models, so the text of a document you process is sent to them:

• Anthropic or OpenAI — drafting, review and answers, from whichever of the two you choose. Your document text and the reference passages relevant to it are sent with each request.
• OpenAI — search indexing. Document text is sent when a document is added and when a search runs.

Both are used under their commercial API terms, which do not train on content submitted through the API. Every credential we hold is limited to the access its task needs.

Organizations that need their content to stay within their own model agreement — for example Azure OpenAI or Amazon Bedrock — can have Qualisera configured to use it, set up with you per engagement.

Documents you add are visible only to your organization. Public regulatory material is shared; your own SOPs, specifications and drafts are not. Each demo account gets its own organization, so evaluation users never see each other's work.

Records a person may later have to account for are written once and superseded rather than replaced in place:

• Every AI edit is a discrete accept-or-decline decision, and the revision history logs what was suggested, what the human decided, who decided it, and when.
• User administration — accounts added, roles changed, access granted or revoked — is written to an append-only trail.
• A generated analysis someone has read and acted on is retained when it is regenerated, because it is a record of what this system told them.

Being precise about the boundary matters more than a claim. RegLens maintains an audit trail over revisions and authorship. Authenticated electronic signatures — an identified user re-authenticating to sign, with the meaning of the signature recorded — are enforced in TMS. The software is built to support work under Part 11; validation of your own processes and records remains yours.

Conversation history is retained for a period your organization sets, 90 days by default, and swept automatically after that. Documents you add remain until you remove them. On request we will delete an organization's data and confirm when it is done. A data processing agreement is available on request.

Accounts are created by invitation or by an approved evaluation request — there is no open self-registration into an existing organization. Administrators can disable an account immediately, and every administrative action is recorded. The application is served over HTTPS only. Single sign-on can be set up for organizations that require it, arranged per engagement.

Send security or data-protection questions to hello@qualisera.ai, or use the contact form. We will complete a vendor-qualification questionnaire.