21 CFR Part 11: what the Ivy record covers
How Ivy's hash-chained, time-stamped audit trail maps to FDA 21 CFR Part 11, clause by clause: what the platform provides today and what your team adds.
FDA 21 CFR Part 11 sets the conditions under which electronic records and signatures are trusted in place of paper. No software is "Part 11 compliant" on its own: compliance belongs to a regulated organization's validated system, procedures and people. What a platform can do is supply controls those procedures rely on.
This page maps each relevant clause to what Ivy provides today and what remains your team's job. Ivy's Part 11 readiness is in progress, and the status page tracks it. The mechanism behind the audit-trail rows is described in The audit trail of a run.
Clause by clause
| Clause | What it asks for | What Ivy provides today | What you still need |
|---|---|---|---|
| §11.10(a) Validation | A system validated for accuracy, reliability and consistent performance | Nothing that substitutes for validation. Ivy publishes no validation package today | Your own risk-based validation of the workflows you rely on |
| §11.10(b) Copies | Accurate, complete copies in human-readable and electronic form | Per-job export with raw inputs, parameters, audit trail and checksums; a chain-of-custody report as JSON or HTML | Confirmation that the export covers your record definition. A chat's long message bodies sit outside the chain |
| §11.10(c) Record protection | Records retrievable throughout their retention period | Records are kept, and the hash-chained logs are retained even through erasure requests | Enforced retention periods and legal holds, which Ivy does not yet offer |
| §11.10(d) Limited access | Access limited to authorized individuals | Authentication with multi-factor support; database row-level security scoped to your tenant | Your user provisioning and review procedures |
| §11.10(e) Audit trail | Secure, computer-generated, time-stamped audit trails of record creation, modification and deletion that do not obscure earlier entries | Every event of a signed-in run is hash-chained (SHA-256), rolled into Merkle roots, and time-stamped by an RFC 3161 authority. You can verify a chat's chain yourself | A reason-for-change field (none today). Note that a single event's timestamp is not covered by its hash; the time-stamp covers the chain segment |
| §11.10(g) Authority checks | Only authorized individuals can use the system or alter records | Role-based access control across organization, project and chat | Your role assignments |
| §11.10(k) Documentation controls | Control over system documentation | Public docs and a dated changelog | Your controlled copies and change control |
| §11.50, §11.70 Signatures | Signed records show the signer, time and meaning, and signatures are linked to their records | Not available. Ivy has no electronic-signature workflow in production | An e-signature step outside Ivy, or wait for this row to move |
| §11.100, §11.300 Identification | Unique user identity and controls on credentials | A unique identity per user, multi-factor authentication, and API keys bound to an account | Your identity proofing and credential procedures |
What the audit trail adds
Many AI and LLM tools keep logs that whoever runs the database can change without trace. Ivy's record is different in one checkable way: a change to any recorded event breaks the chain, and you can run the check from your own account without asking Ivy for anything. The RFC 3161 time-stamps come from an outside authority, so they do not depend on trusting Ivy's own clock for when a segment existed.
The boundary matters as much as the claim. The chain detects modification; it does not prevent it, and a privileged database role can still edit rows. Treat the record as tamper-evident evidence that feeds your procedures, not as a substitute for them.
Related
Was this page helpful?
The audit trail of a run
Every signed-in run writes a hash-chained, RFC 3161 time-stamped record you can verify yourself. What the chain catches, what it does not, and how to check.
Audit trail FAQ: hash chains, time-stamps and Part 11
Is Ivy 21 CFR Part 11 compliant? Can the audit trail be edited? How to verify a chat, what RFC 3161 time-stamps prove, and what happens on GDPR erasure.