The most complete, inspection-ready
digital production record in pharma.
What's live today, what we're building, and where we're headed — published the way an inspector would read it.
This roadmap reflects our current direction and is provided for transparency. It is not a commitment, obligation, or promise to deliver any feature, capability, certification, or validated functionality, and you should not rely on it when making purchasing or compliance decisions. Only items marked “Live in production” are running in production today; all other items are forward-looking and subject to change. These statements speak only as of the date shown.
Live today
Running in production right now, on real data. Every claim below is something an inspector could open and check.
Real-time safety limits
Unconditional hard-limit, specification and slope checks on every reading of every batch — a gross excursion never waits on a model.
Immutable audit trail
Append-only events log, SHA-256 hash-chained per batch — tamper-evident by database trigger, not application code.
21 CFR Part 11 e-signatures
Bound electronic signatures for batch release and report approval, each carrying signer name, role, meaning and chained hash.
Inspection Readiness Pack
One-click cryptographically sealed audit archive — sharded ZIP, inspector cover PDF, per-batch and pack-wide Merkle trees, draft → finalized → superseded lifecycle.
Hosted pack verifier
Drop any BatchCortex pack into the browser and check its Merkle integrity entirely client-side — no upload, no account.
PDF/A conformance
Inspection-pack PDFs validated to PDF/A-2B by a veraPDF service for long-term archival.
Product Quality Review (PQR)
Cpk, OOS/OOT and Nelson-rule analysis with PDF export and a Qualified Person approval block.
Per-batch evidence depth
LIMS at-line QC, material genealogy with recall trace, and NIR PAT input-drift — captured per batch via CSV import today; vendor adapters are Next.
On-prem edge agent
Runs at the customer site against read-only OPC-UA with local store-and-forward buffering, on an EU-sovereign cloud backend.
4-tier escalation
Email → SMS → emergency voice call across QA, Admin and the Qualified Person, all EU-routed (Twilio Dublin).
EU-resident by construction
Mistral (FR), Vercel fra1, Twilio Dublin, Supabase EU — every production workload runs in EU regions, with no data routed through US infrastructure. Deeper jurisdictional and customer-controlled sovereignty is staged on the roadmap below.
How to read this page
Running in production today.
Built or running in advisory mode — not validated, not a decision gate.
Committed direction, scoped, not yet started.
Low-confidence research bet.
One architecture, drawn around trust.
We're migrating to a security-led platform where each layer is chosen for the risk it carries — one capability at a time, parity-gated, with the validated product and the deterministic safety floor live throughout.
- Rustprotects the machine boundary — capture, the local buffer, deterministic safety checks and signed evidence.
- Gogoverns the distributed system — device identity, ingestion, authorization, workflow and model rollout.
- Pythondevelops and validates the intelligence — training, calibration and signed model releases.
- PostgreSQL + pgvectorrecord authoritative truth and retrieve derived knowledge.
- TypeScriptmakes the result legible — while every decision is re-checked server-side.
- Cryptographic witnessespreserve trust even after a compromise — keys and proofs held outside the primary system.
Where we're headed
Next · Q3 2026
Building · validation pendingFull detection stack in advisory mode
All 10–11 detectors — including an unsupervised Isolation Forest that learns each batch's normal envelope on-site — deployed and running in advisory / shadow mode while validation runs against the pilot's real batch data and a published 1,005-batch reference dataset (Lek/Novartis). The first detectors graduate to Live through our Annex 22 validation gate as evidence accumulates — we never mark a model Live until it earns it.
Annex 22 §4 / §7Building · validation pendingFormal validation packages
Real model-deployment records and documented validation evidence for each detector that reaches production.
Annex 22 §7 / 21 CFR Part 11 §11.10(e)Building · validation pendingDeployment-profile ladder
From shared EU SaaS today to dedicated single-tenant, customer-cloud, on-premises and fully air-gapped — the customer chooses how much of the stack runs inside their own walls. The standalone container build is the head start.
Building · validation pendingVendor integration adapters
Direct connectors for LIMS (LabWare, STARLIMS) and MES/ERP (SAP, PAS-X), moving beyond CSV import during onboarding.
Building · validation pendingRust plant-edge data plane
A memory-safe Rust edge that owns OPC-UA capture, a local write-ahead buffer, deterministic safety checks and signed evidence chunks — so the safety floor and the on-site record keep running through any cloud, model or network outage. Migrating from the Python agent capability-by-capability, parity-gated, with the validated path always live.
Annex 11 §12.1Building · validation pendingGo cloud control plane
A dedicated Go service layer for device identity, ingestion, authorization, workflow and model rollout — introduced behind the current API through gated migration, one capability at a time, so nothing customers have already validated changes underneath them.
Later · Q4 2026+
PlannedFull validated detection ensemble
The complete 10–11 layer ensemble, each layer earning production status incrementally as pilot data accumulates — our north-star for the deepest evidenced detection in pharma.
PlannedTrusted timestamps & long-term signatures
RFC 3161 trusted timestamps and PAdES-LTV long-term validation on every sealed pack, with signing keys held outside the database and an independent witness copy — so a pack's integrity can be proven even against a fully compromised backend.
PlannedOffline Rust/Wasm pack verifier
The pack verifier compiled to WebAssembly so an inspector can check signatures, Merkle roots and timestamps fully offline — no BatchCortex service in the loop, ever.
PlannedJurisdictional & customer-controlled sovereignty
Beyond EU residency toward EU-incorporated providers, customer-held encryption keys and an independent EU evidence archive the application itself cannot delete.
PlannedDeeper per-batch evidence
Per-tablet compression waveforms, 100% vision-inspection ingestion, granulation endpoint and bearing-condition monitoring.
PlannedData partnerships
Integrate with the systems customers already run, turning shared production data into joint evidence.
PlannedBroader production platform
More dashboards and product surface toward the most complete digital production record in pharma.
Exploring
ExploringAnnex 22 adaptive-model governance
We are investigating a conservative-mode governance framework for adaptive models that satisfies the strictest reading of EU GMP Annex 22.
ExploringAdditional attestations
We are evaluating SOC 2 and ISO 27001 attestations as customer demand warrants.
What we won't ship
A roadmap is also a set of lines we will not cross. These are commitments, not omissions.
No continuously-learning models in critical GMP paths until Annex 22 is final and a validated evidence package exists.
No generative AI making batch-release decisions — we advise, the Qualified Person decides.
No US-region production data — every production workload stays in EU regions.
No self-signup — invite-only; the customer's admin controls access.
Where the company is going — not product ship dates. Timeframes here are business targets, not feature commitments.
First paid pilot
Targeting our first production pilot — H2 2026.
Funded growth
Building toward pre-seed funded growth.
See where it stands on your own line.
The fastest way to judge a roadmap is to run the live product against your real batches.
This roadmap reflects our current direction and is provided for transparency. It is not a commitment, obligation, or promise to deliver any feature, capability, certification, or validated functionality, and you should not rely on it when making purchasing or compliance decisions. Only items marked “Live in production” are running in production today; all other items are forward-looking and subject to change. These statements speak only as of the date shown.
Status as of 2026-06-20