Technical controls.
Operational responsibility.
Agilix implements controls relevant to electronic records and signatures. Their effectiveness must be assessed in the intended use, qualified deployment and organizational quality system.
Understand the control.
Understand its boundary.
Audit trail
Recorded actions retain UTC time and actor/action context. A hash-chain verification workflow supports integrity review.
Boundary: a hash is not encryption, and chain verification does not prove event completeness or absolute protection from privileged storage changes.
Access and authority
Account, study, site, permission and blinding checks constrain operational access. Account administrator scope remains separate from system administration.
Boundary: approved provisioning, periodic review, timely deactivation and user training remain organizational responsibilities.
Electronic signatures
Supported signed actions request authentication and justification, retaining linkage to the affected workflow or document event.
Boundary: signature policies, identity verification and legal/accountability requirements must be established by the organization.
Copies and retention
Permission-scoped exports support review. Account document versions and archived bytes are retained; ordinary reporting exports are explicitly unsigned.
Boundary: define retention periods, archive accessibility, complete-copy requirements and backup/restore evidence for the actual records.
A foundation for review.
Not a certification claim.
Controlled requirements, design, test and traceability documents support the quality review. Developer tests are valuable evidence, but do not substitute for approved intended-use validation or independent acceptance.
Validation and change control
Approve intended-use requirements, risk assessments, acceptance protocols and deployment qualification. Assess study amendments and software changes before release under the quality system.
Timeouts and authentication
Review configured session behavior, failed-login controls and reauthentication against approved policies. Permission changes revoke affected sessions; browser behavior alone does not prove timeout enforcement.
Encryption and infrastructure
Validate TLS, database/volume protection, key persistence and encrypted backup controls in the target environment. Local HTTP and database inspection are development conveniences, not evidence of encryption in transit.