21 CFR Part 11 matters when electronic records or electronic signatures are used to satisfy applicable U.S. Food and Drug Administration (FDA) requirements. Pharmaceutical, biotechnology, clinical-research, and other regulated organizations may need to evaluate Files.com as part of a system that exchanges or maintains those records.

Begin with the regulated process and its required records. Part 11 applicability depends on the underlying FDA recordkeeping requirements and the electronic records or signatures used to meet them. The FDA's scope and application guidance explains these “predicate rules” and the scope of Part 11.

Customer Validation and Files.com's Role

Files.com supplies a configurable file orchestration service. Your organization validates its intended use, configuration, integrations, and operating procedures. Files.com supports that assessment with documentation of standard platform capabilities and change controls; we do not perform validation on the customer's behalf.

The relevant outcome is a validated system and process for your intended use. A general statement that a platform supports Part 11 cannot establish the suitability of every configuration or every record-handling workflow. Your quality and compliance teams determine the applicable requirements and the evidence needed to demonstrate that the configured system meets them.

Controls to Evaluate

Identify which parts of your record lifecycle Files.com performs and which parts remain in other applications or procedures. Evaluate the controls together, including:

Identity and authority. Establish who may create, read, change, approve, or remove records. Include user and group permissions, administrative roles, authentication policies, and credentials used by automated processes.
Activity records. Evaluate the events recorded, the associated identity, timestamps, and the details available for review. File-operation history is distinct from an application recording the reasons for a change or the meaning of a regulated approval.
Retention and retrieval. Define the required lifetime of records and supporting audit information, how they are retrieved, and who may alter or remove them. File retention, deleted-file recovery, archives, and log retention have different effects.
Connected systems. Include the applications producing, approving, receiving, or retaining the records. A successful transfer confirms delivery according to the transfer's behavior; your process must establish any additional record acceptance or approval it requires.

Customer Control Over Data and Data Retention & Deletion describe the supported controls and their boundaries. These references link to the detailed configuration instructions.

Electronic Signatures

If your regulated process requires electronic signatures, evaluate the signing application, signer identity, signature meaning, and linkage to the signed record as part of validation. A login, upload event, or transfer receipt alone does not establish a regulated approval. A cryptographic signature used by a transfer protocol has a different purpose from a person's signature approving a regulated record.

The FDA's electronic systems and signatures guidance for clinical investigations explains relevant record and signature considerations. Determine how the signing process and Files.com exchange fit together without assuming that one validates the other.

Supplier Evidence and Change Control

Our SOC 2 Type II report and software development and change-management practices support a supplier assessment. Review the report's scope and request the documentation appropriate to your review through Document Requests. Discuss any proposed Quality Agreement with your account team for Legal review.

Organizations needing formal review of web-interface changes can evaluate the paid GxP validation option for the web interface, available with Enterprise Support. That option provides control over the web-interface version and corresponding documentation. Shared API and file-transfer services continue updating, so validation and change control must also account for those services and your connected applications.