Skip to main content
QMSQMS
QMS
  • Welcome to your QMS
  • Quality Manual
  • Procedures
  • Records
    • GP-001 Documents and records control
    • GP-002 Quality planning
    • GP-003 Audits
    • GP-004 Vigilance system
    • GP-005 HR and training
    • GP-007 Post-market surveillance
    • GP-009 Sales
    • GP-010 Suppliers
    • GP-012 Design, Redesign and Development
    • GP-018 Infrastructure and facilities
    • GP-019 Software validation
      • Deprecated
      • R-019-001 Software validation report_Atlassian_2023
      • R-019-001 Software validation report_HubSpot_2024
      • R-019-001 Software validation report_GitHub_GPG key signature_2024
      • R-019-001 Software validation report_Atlassian_2024
      • R-019-001 Software validation report_CVAT_2024
      • R-019-001 Software validation report_Docker_2024
      • R-019-002 External software list
    • GP-023 Change control management
    • GP-050 Data Protection
    • GP-051 Security violations
    • GP-052 Data Privacy Impact Assessment (DPIA)
  • TF_Legit.Health_Plus
  • Licenses and accreditations
  • External documentation
  • Procedures
  • Records
  • Records
  • GP-019 Software validation
  • R-019-001 Software validation report_GitHub_GPG key signature_2024

R-019-001 Software validation report_GitHub_GPG key signature_2024

Scope​

The aim is to gather additional requirements and configuration specifications not encompassed within the application, together with their respective validations. This ensures adherence to both our internal requirements and those imposed by regulatory bodies. This involves detailing specifications and criteria which are external to the application but fundamental for ensuring our outputs align with all requisite standards and regulations.

Software description​

Name​

GitHub.

GPG signature

It is worth mentioning that we use GitHub alongside the GPG technology to verify our commits. GPG is a suite of cryptographic software that can be used to encrypt or sign data and communications to ensure its authenticity.

The GPG signature enables our use of GitHub to be compliant with the requirements of 21 CFR Part 11.

Manufacturer​

GitHub, Inc., owned by Microsoft

Intended use​

We selected GitHub to have a controlled system to be used:

  • As our Quality Management System (QMS), to contain all the procedures and records required, compling with the applicable regulations.

Risk-based analysis​

Quality Management System (QMS)​

The software is used as a controlled quality management system to document and register the procedures and records required to safetly perform the design and manufacturing of the medical devices. This software is well-established and validated, therefore, its failure to perform as intended should not result in a quality problem that foreseeably leads to compromised safety. As such, the software does not pose a high process risk.

Requirements and design specification​

Quality Management System (QMS)​

  • Requirement 01: Users sign the documentation according to their role and in compliance with the 21 CFR part 11.
  • Requirement 02: Only the approved versions are released and visible to the users.

Assurance activities and test plan​

In addition to the tests and checks designed to ensure the configuration complies with the establised requirements, we have performed an assessment of the system capability (see R-002-007 Process validation card 2023_003) and a supplier evaluation (see R-010-001 Suppliers evaluation), being considered the only tool providing, in the same ecosystem, a task manger, a knowledgebase and a git code repository. This makes it perfect to manage all the process mentioned: QMS, DHF and NC & CAPAs applications.

Quality Management System (QMS)​

IDTest descriptionAcceptance criteriaRequirement tested
Test 01Verification of the electronic signatureSignature comply with the regulatory requirementsRequirement 01
Test 02Approval version releaseOnly the approved versions are released and visible to the usersRequirement 02

Test Results and deviations detected​

Quality Management System (QMS)​

Test 01​

  • Result: Pass
  • Deviation: No deviations found

evidence of GPG evidence of GPG

Test 02​

  • Result: Pass
  • Deviation: No deviations found

evidence of GPG

Design review​

Result
Have the appropriate tasks and expected results, outputs, or products been established for each software life cycle activity?TRUE
Do the tasks and expected results, outputs, or products of each software life cycle activity:
Comply with the requirements of other software life cycle activities in terms of correctness, completeness, consistency, and accuracy?TRUE
Satisfy the standards, practices, and conventions of that activity?TRUE
Establish a proper basis for initiating tasks for the next software life cycle activity?TRUE

Conclusion​

No error is observed in the signature procedure implemented: it allows us to comply with 21 CFR part 11, as we can always check the version of the document, the changes introduced in it and the person responsible for each modification. All employees making any changes to any document, or review and approval activities, must sign each commit as a mandatory activity.

In addition, the implemented procedure prevents users from viewing unapproved versions of documents.

Signature meaning

The signatures for the approval process of this document can be found in the verified commits at the repository for the QMS. As a reference, the team members who are expected to participate in this document and their roles in the approval process, as defined in Annex I Responsibility Matrix of the GP-001, are:

  • Author: Team members involved
  • Reviewer: JD-003, JD-004
  • Approver: JD-001
Previous
R-019-001 Software validation report_HubSpot_2024
Next
R-019-001 Software validation report_Atlassian_2024
  • Scope
  • Software description
    • Name
    • Manufacturer
    • Intended use
  • Risk-based analysis
    • Quality Management System (QMS)
  • Requirements and design specification
    • Quality Management System (QMS)
  • Assurance activities and test plan
    • Quality Management System (QMS)
  • Test Results and deviations detected
    • Quality Management System (QMS)
      • Test 01
      • Test 02
  • Design review
  • Conclusion
All the information contained in this QMS is confidential. The recipient agrees not to transmit or reproduce the information, neither by himself nor by third parties, through whichever means, without obtaining the prior written permission of Legit.Health (AI LABS GROUP S.L.)