Security controls for pharmacy workflows.
CompliRx uses access controls, facility-scoped records and electronic-record history. Review these controls alongside your intended use, deployment configuration and required contractual and validation evidence.
Review the controls and their scope.
Security controls that pharmaceutical facilities can rely on, from database isolation to application hardening to infrastructure.
Encryption
Review transport, storage and integration-credential controls for the services in your deployment.
- HTTPS for browser connections
- Managed database and storage encryption; confirm provider scope during review
- Encrypted credential storage for sensor integration API keys
- Secure session management with automatic expiration
Tenant isolation
Facility and organization access controls scope operational records to authorized users.
- Row-Level Security policies for tenant-scoped records
- Facility-scoped filtering for operational record access
- Organization-scoped access control for multi-facility operators
- Security-definer functions prevent RLS policy recursion
Access control
Granular role-based access control ensures the right people have the right permissions.
- 4-tier RBAC model: admin, manager, operator, viewer
- Resource:action permission format for granular control
- Team-based access pools with qualification gating
- Invitation-based staff onboarding
- User-to-facility access matrix for multi-site operators
Electronic record history
Recorded activity and electronic-signature integrity checks support review of covered workflows. Evaluate event coverage and retention for your intended use.
- Activity logging for configured record workflows
- Compliance-relevant event flagging for inspection review
- Electronic signature hashing using SHA-256 with deterministic key sorting
- Context capture for supported electronic-signature workflows
- ALCOA+ principles: Attributable, Legible, Contemporaneous, Original, Accurate
- Password re-authentication required at time of signing
Application security
Application controls include response policies, content sanitization and input checks.
- Content Security Policy headers for application and public-page responses
- XSS protection via DOMPurify sanitization on user-generated content
- File upload validation: type whitelist, size limits, magic byte verification
- Rate limiting on authentication endpoints
- Input validation in supported API workflows
- Retry logic with exponential backoff (skips 4xx, retries 5xx and network errors)
Infrastructure
Managed infrastructure with automated operations, edge-distributed compute, and built-in redundancy.
- Supabase (PostgreSQL) managed database with automated backups
- Vercel deployment with global edge network and DDoS protection
- Deno edge functions with isolated execution sandboxes
- Deployment secret management for integration credentials
- Confirm backup retention, restoration testing and recovery options for the deployed service plan
Compliance readiness
Assess the controls, contracts and validation evidence relevant to your facility before implementation.
- Request available independent assurance documentation; this page does not claim SOC 2 certification
- Confirm any required BAA and service scope before processing protected health information
- Electronic-record controls to evaluate against applicable Part 11 requirements
- Record history and reporting for internal review and inspection preparation
- Operational records for USP-related workflows; facility responsibilities remain
Electronic signatures alone do not establish regulatory compliance. FDA’s Part 11 scope guidance explains the assessment of applicable electronic records. Confirm the evidence and responsibilities for your intended use.
Ready to secure your compliance workflow?
Review access, record history and deployment requirements with your security and quality teams.