Change recorda41c9e2 → main
- Re-run on your runner, passed14
- Carried forward, each with its reason211
- Still unproven0
Waiting on V&V lead
Every release
starts validation from zero.
ships with its proof.
For teams building SaMD and connected medical devices. Sentula follows every change to your software, re-runs the verification it touches, proves in writing why everything else still holds, and puts one record in front of the person who signs.
Delivered by SpiceFactory MedTech, from first requirement to signed submission.
- 21 CFR 820Quality system (QMSR)
- 21 CFR Part 11Electronic signatures
- FDA GPSVSoftware validation
- IEC 62304Software life cycle
- ISO 14971Risk management
- ISO 13485Quality management
The quiet tax on every release.
A developer changes two lines in an alert threshold. Two requirements are touched. Before the release ships, your team re-runs all 225 protocols, by hand where they're manual.
Not because the change is big. Because nothing in a hand-kept trace proves the other 223 still hold. Neither IEC 62304 nor FDA's software validation guidance asks you to re-run everything. They ask you to analyse each change's impact and re-test what it could affect, with the reasoning on record. That reasoning is the part nobody has time to write.
Sentula writes it, for every change, and your people sign it.
Requirements the change touches2
Protocols re-run today225
With Sentula: re-run, and carried forward with a signed reason14 + 211
$7.5–9.5B a year
is what the medical-device industry loses to nonroutine quality and compliance failures. Evidence that keeps up with every change is how you stay out of that number.
McKinsey, Capturing the value of good quality in medical devices (2017).
Picture your next release.
Quality signs with confidence. V&V proves every change. Engineering ships on schedule. Here's where each of you will be.
Head of Quality & Regulatory
Signs the release. Owns the audit.
The one with the answer before the auditor finishes the question.
- Every release arrives with its controlled documents already redlined.
- Every scope decision comes with a cited, signed reason.
- Trace gaps surface the day the code changes, with the fix already proposed.
Your next auditThe auditor asks why TC-114 wasn't re-run. You open the release record. The answer is already there, cited and signed.
What you'll say“Every protocol we didn't re-run has a signed justification.”
V&V and QA lead
Proves the release.
Every release proven, and your weekends back.
- You approve a focused scope, and your own runners do the work.
- Unchanged manual protocols carry forward, each with its written reason.
- Evidence lands on every run, hashed and attached to its requirement.
Your next release211 protocols carry forward with proof. Your attention goes to the 14 that matter.
What you'll say“Scope approved at 14:03. Signed at 16:45.”
CTO and engineering lead
Ships the software.
Ship on your schedule, with compliance already done.
- Developers stay in their pull requests; one check tells them all they need.
- Evidence is written as you merge, so release week is a signature, not a project.
- When a trace gap appears, Sentula opens the pull request that closes it.
Your next release weekThere's nothing left to assemble. Quality signs the record that's already there.
What you'll say“We ship on our schedule, and the DHF keeps up.”
Here's what happens to a change instead.
One merge, followed from commit to signature: the audit trail Sentula writes for every change, as it happens.
Change recorda41c9e2 → main
| Pull request | #482 · Tighten alert threshold |
| Files changed | 6 |
| Requirements touched | SRS-ALRT-04, SRS-ALRT-07 |
| Risk controls touched | RC-12 |
| Check on the pull request | sentula/gate passing |
No forms. The record starts from the merge itself, not from someone remembering to open a ticket.
Impacta41c9e2
Unknown is not "none". If a changed path isn't mapped, Sentula says so and widens the scope. It never reads a gap as unaffected.
Scoped re-verificationrunner: lab-mac-02
| TC-ALRT-04-1 | Alert fires within threshold | passed |
| TC-ALRT-04-2 | Alert suppressed below threshold | passed |
| TC-ALRT-07-1 | Clinician notified once per event | passed |
Your runners. GitHub Actions, a lab Mac, a container. Pass or fail comes from the tests, never from a model.
Proof for this change225 protocols
- Re-run and passed14
- Carried forward with proof211
- Unproven0
Typical traceability tool211 items marked suspect. Clear all?
Sentula211 proven Each cites change a41c9e2 and the bindings it does not reach.
The part others leave to a checkbox. A written reason per protocol, including manual ones, that a reviewer can check and sign.
Software Requirements Specificationrev. 14 → 15
SRS-ALRT-04The system shall raise an alert when the reading exceeds the configured threshold
for 3 consecutive samples for 2 consecutive samples within 60 seconds.
Refuses on doubt. If the evidence hash chains don't verify, nothing generates. Every file is reopened and validated before it's recorded.
Electronic signature21 CFR 11.50
- Signed by
- A. Moreno, V&V lead
- Meaning
- Approved: verification complete for change a41c9e2
- Date and time
- 2026-10-14 16:45:30 UTC
- Record
- sha256:7f3c0e91d4b2a6f58e0c1d93b7a4e2f6c8d0b1a3e5f7092c4d6e8f0a1b3c5d7e
An invariant, not a policy. Agents propose. The permission model gives them no way to approve or sign.
Evidence bundlerelease 2.4.0
| Controlled documents | tracked-changes .docx |
| Evidence ledger | hash-chained, signed |
| Delivery | upload to your QMS, or SharePoint push |
Your system of record stays yours. Filed in any QMS as a signed bundle, or pushed straight to your SharePoint library.
Agents draft.Your tests decide.People sign.
AI does the work that costs weeks. The evidence path stays deterministic, so an auditor can replay any line of the record.
- Results come from executionPass or fail is read from your test runs. No model judges an outcome.
- Agents have no authorityThey propose. Approvals and signatures need a person, enforced in the permission model.
- Four eyes on every decisionThe author of a change or a document can't approve it.
- A digital ledger, tamper-evidentEvents and evidence are hashed into chains. If a chain fails to verify, nothing is generated.
- Same inputs, same recordDocuments regenerate identically from the same evidence.
- Patient data stays out of modelsPHI is redacted before any model call. Bring your own AI, on your own hardware.
Underneath your QMS. On top of your pipeline.
Sentula isn't another eQMS and doesn't replace your traceability tool. It does the work between your code and your quality system that people do by hand today.
Your QMSKeeps the controlled record, the approvals and the audit it already owns.
SentulaFollows each change, scopes and runs verification, proves the rest, drafts the documents, collects signatures.
Your trackersJira or Azure Boards, each work item linked to the changes that implement it.
Your code and CIGitHub, GitLab, Bitbucket or Azure DevOps. Sentula proposes pull requests; it never merges.
Your runnersCI jobs, lab machines and containers you already run.
Working with SpiceFactory MedTech.
We build your device software and your FDA compliance pack together, with Sentula running underneath. One team, fixed price, from first requirement to signed submission.
- A 30-minute fit callTell us what you're building and where you are. We'll say plainly whether we're the right team, and what we'd do first.
- A fixed-price first buildAbout a month. Sentula connects to your repositories and runners, and you watch your own changes produce their proof.
- Ship with the proof built inProduct engineering and the compliance pack move together, release after release, into the QMS you already run.
- Where a bug is a recallHealthcare, medtech and connected devices, from our Boston studio.
- Evidence that has gone to FDAVerification evidence we produced has been part of an FDA De Novo submission.
- Never billed by the hourYou know the scope and the cost before we start.
The questions Quality asks first.
Straight answers. If yours isn't here, put it in your note below.
Do we have to replace our QMS or traceability tool?
No. Sentula sits underneath them. It produces a signed evidence bundle with tracked-changes documents that you file in the QMS you already run, or push to a SharePoint library. Your system of record stays yours.
Does AI decide whether our software passes?
Never. Pass or fail is read from your test runs. Agents trace impact, draft documents and propose fixes, but they can't approve or sign anything; that's enforced in the permission model.
How can carrying protocols forward be defensible?
Each carried-forward protocol has a written reason traced to the change set: the change doesn't reach anything the protocol covers. A second person approves the scope, and anything Sentula can't justify, such as an unmapped file, stays in scope. You sign the reasons with the release.
What does our engineering team have to do?
Connect your repositories and runners once. After that, developers never log in: they see one check on their pull request. Sentula proposes pull requests to close trace gaps and never merges anything itself.
Which tools does it work with?
GitHub, GitLab, Bitbucket and Azure DevOps for code; Jira and Azure Boards for work items; SharePoint or a signed bundle for your QMS. We connect the ones you use as part of your engagement, and your tests keep running where they run today: CI jobs, lab machines, containers.
Are the signatures Part 11 compliant, and will we need to validate Sentula?
Signatures carry the printed name, meaning, date and time, bound to a tamper-evident record, and the author of a change can't approve it. Like any tool in your quality system, you'll assess Sentula under your own computer software assurance process, and we'll support that assessment.
What about patient data?
Sentula works on code, tests and documents, not patient records. Anything that looks like protected health information is redacted before any model call.
Tell us about your product.
No long form. Write a few lines the way you'd explain it to a colleague.
- You write a short note. What you're building, where you are, what you need.
- Our intake agent reads it first and drafts a summary for the team, so nothing waits in a queue.
- A SpiceFactory MedTech lead replies personally with next steps.