It costs most when you can least afford it
Assembling the story of a study during an inspection consumes the same senior people who are managing the inspection.
Evidence Data Trace
Reconstructing what happened costs more than recording it properly.
When an inspector, a partner or your own quality team asks how a result was produced, most organizations answer by assembling it - from tickets, mailboxes, spreadsheets and the memory of whoever is still there. Evidence Data Trace records it as the work happens, in a form a regulated professional can read.
Recorded as work happensReadable without usRetained 25 years
What we have to offer
Three parts. None of them is the product on its own - a workforce without governed execution is a generic agent platform, and governed execution without your data and your authority is somebody else’s system.
One - the work
Performed, not tooled.
Biostatistics, medical writing, regulatory, safety and HEOR executed end to end by governed specialists you scale without hiring, built for pharmaceutical work rather than adapted to it.
Two - the proof
Proven while it runs.
Policy is evaluated before a task is dispatched, not reviewed after it lands, and every result arrives with the evidence record that defends it.
Three - the authority
Under your authority.
Your data and your models, deployed where you choose - managed, in your VPC, embedded, or air-gapped - with every decision right resolved to a named person in your organization, never to the platform.
The problem with reconstruction
An audit trail assembled after the fact is an argument, not a record.
Reconstruction is expensive, slow and least reliable exactly when it matters most - years later, when the people have moved on and the tooling has changed.
It degrades with time
Every departure, migration and tooling change removes part of the chain. What is left is inference.
It cannot prove a negative
Logs show what was done. They rarely show what was refused, by which control, and why - which is the question a regulator actually asks.
Seven inputs, one record, created as the run happens rather than assembled afterwards. The same record proves what did not happen - a refused action leaves a refusal record, not silence.
The records
Three documents a Fleet leaves behind.
These are not exports or log dumps. They are the artifacts your quality function, your QPPV and your inspector actually work with.
What a completed analysis leaves behind.
Every governed run produces an Evidence Data Trace record: what was run, on which data, under which controls, by which engine, and which named human accepted the result. Open schema, queryable, exportable - readable without us.
Evidence Data Trace Record
EDT-2026-004182 · Study ONC-2026-014 · generated 14 Aug 2026, 09:42 UTC
Illustrative governed-run record - synthetic study dataEvery study, identifier, person and figure shown here is fictional. The record is reproduced in full to demonstrate its structure, not to report a customer deployment.
Run identity
Method and reproducibility
Inputs and outputs are hashed at execution. Re-running this analysis reproduces it exactly - or it fails loudly and says why. It will not quietly return a different answer.
Data lineage
| Source | Preparation applied | Classification |
|---|---|---|
| Oncology registry extract1,412,880 patient records | Mapped to common model · de-identified in place | De-identified |
| Sponsor trial dataStudy ONC-2026-014 | Normalized in place · no copy taken | De-identified |
| Licensed terminologyMedDRA, WHODrug | Entitlement verified before resolution | Entitled |
Controls evaluated by the Sentry Agent
| Control | Requirement | Result |
|---|---|---|
| Analysis authorityCTL-RWE-014 | Method approved for use and within worker clearance | Pass |
| Data residencyCTL-GOV-002 | Execution confined to the sponsor perimeter | Pass |
| Estimand disciplineICH E9(R1) | Estimand declared before execution; sensitivity suite run | Pass |
| License entitlementCTL-DAT-009 | Entitlement valid for every licensed asset resolved | Pass |
Human authority
A. Okafor
Biostatistics Lead · Sponsor organization
Signature meaning: approved for inclusion in the submission dossier
14 Aug 2026
11:07 UTC
Signature recorded
11:07 UTC
Signature recorded
StromaOS computed, ranked and drafted. It did not decide. Selection resolved to a named authority inside your organization, recorded with what the signature meant.
Retention: 25 years · sponsor-owned
Export: SQL, CSV, PDF · open schema
What happens when a worker oversteps.
A Worker Agent attempted an analysis over data above its clearance. The Sentry Agent refused it before dispatch - the action never reached a model. No surprise output, and no partial state in your safety database.
Governance Exception Record
EXC-2026-000417 · raised 11 Aug 2026, 16:23 UTC · severity S2
Illustrative governed-run record - synthetic study dataEvery study, identifier, person and figure shown here is fictional. The record is reproduced in full to demonstrate its structure, not to report a customer deployment.
Summary
Why it was refused
| Check | Finding | Result |
|---|---|---|
| Data classificationCTL-GOV-011 | Requested patient-identified data; worker cleared for de-identified only | Fail |
| Method authorityCTL-PV-006 | Method approved, but not at the requested classification | Blocked |
| DispatchPre-execution gate | Execution halted; no partial state written | Halted |
Action taken
The worker’s authority ceiling was reduced pending review, the exception was routed to the Qualified Person for Pharmacovigilance, and the run was recorded as refused rather than failed - so the reason survives in the audit trail.
Escalated to the QPPV
Qualified Person for Pharmacovigilance · EMEA
Acknowledged 11 Aug 2026, 16:31 UTC · reviewed and closed 12 Aug
Severity S2
Response 8 min
Closed < 24 h
Response 8 min
Closed < 24 h
Why this matters
A control that could not be evaluated is not a control that passed. Anything that cannot be checked stops the run. A privacy check that can’t reach its service refuses rather than passes. A result set over its limit fails rather than truncating to a number that is quietly wrong.
Recorded whether or not the action succeeded
Visible to Quality, Safety and the platform owner
The control that produced both records.
Controls are not policy documents someone reads and applies by hand. Each one is a specification the Sentry Agent evaluates before the work runs - versioned, owned by a named function, and traceable to the obligation behind it.
Control Specification - Analysis Authority
CTL-RWE-014 · version 3 · effective 01 Jun 2026
Illustrative governed-run record - synthetic study dataEvery study, identifier, person and figure shown here is fictional. The record is reproduced in full to demonstrate its structure, not to report a customer deployment.
The rule, in plain language
An analysis over patient data may run only when the method is approved for use, the data
classification is within the worker’s clearance, and a named authority inside the
sponsor organization has accepted it. Anything below the confidence threshold escalates to
a human rather than resolving.
Specification
Conditions
| Condition | Requirement | On failure |
|---|---|---|
| Method status | Approved for use at this classification | Deny |
| Worker clearance | Data classification at or below worker clearance | Deny |
| Authority ownership | Signatory belongs to the sponsor whose data is being decided about | Deny |
| Confidence threshold | Worker confidence at or above the defined threshold | Escalate |
| Control reachable | Every check able to be evaluated | Stop |
Why it is a control and not a policy page
Selecting a governance profile applies the whole control set for that regulatory posture - its gates, evidence requirements and escalation paths - rather than configuring controls one at a time. A new obligation becomes a version of a control, not a rebuild.
Version 3 · supersedes v2 (Jan 2026)
Change history retained · every evaluation logged
Take one with you
The full record, on a page you can print.
The same document reproduced end to end, with nothing collapsed for the web - useful if quality or a statistical reviewer needs to read it before you talk to us.
What must stay connected
A record is only evidence if the chain holds.
Traceability fails at the joins. These are the connections Evidence Data Trace preserves, and the reason a result can still be defended years later.
Most systems can tell you a document exists. Far fewer can tell you which analysis produced the number inside it, which dataset that analysis read, what was done to that data before it arrived, and who accepted the result.
Each of those joins is where a submission gets expensive to defend.
01
Result to method
Which analysis, which parameters, which seed, which engine build.
02
Method to data
Which sources, at which classification, with which preparation applied.
03
Data to entitlement
Which licenses permitted the use, verified at the moment of resolution.
04
Action to authority
Which controls were evaluated, and which named human accepted the outcome.
The chain, verified live
Sixteen events, each hashed into the next, verified against the ledger while you watch. The footnote at the bottom is the part most systems leave out - this chain proves integrity and order, not method. The R versions, the CRAN snapshot and the e-signature are attested separately, by the tier that executed the work.
Captured from a running instance. Demo tenant on synthetic and public test data.
Governed acceleration
AI can accelerate evidence work without inheriting evidentiary authority.
The Sentry Agent records because it is already evaluating. Traceability is a by-product of enforcement rather than a separate logging exercise bolted alongside it - which is why the record cannot drift from what actually happened.
It records refusals, not just successes
A denied action produces a record with the same standing as a completed one. What did not happen, and why, is part of the evidence.
It replays or it fails loudly
Pinned engines, required seeds and hashed inputs mean a re-run either reproduces exactly or reports why it cannot. It does not quietly differ.
The record outlives the vendor
Open schema, queryable in SQL, exportable. The retention obligation on regulated evidence outlives any commercial relationship, so the record has to be readable without us.
Where to start
Start with one workflow where the audit trail is assembled by hand.
Bring your evidence model to a working session. We will map our records against it and show you the gaps in both directions, including ours.