Trust centre

For your QA, IT, and security teams.

PharmaDiagrams is the source of truth for a drawing while it is live: the working record as it moves between people and organisations. It is not the validated system of record for the approved drawing; that stays in your DMS. This page sets out what that means, where your data sits, and what we are, and are not. Forward it to whoever needs it.

The working record, not the validated one: Your validated DMS keeps the approved record. We are the source of truth while the drawing is live.
GAMP Category 1: An authoring tool: qualified, not validated. No new validation burden.
Your data stays in the EU: Stored in the European Union. A DPA is available on request.
Private by default: A drawing opens only for the people you grant access to. Share links are read-only and you can revoke them.
Runs in the browser: Nothing to install, no admin rights, no IT ticket.
Fully exportable: PNG and JSON, any time. Your work is yours to take.

The record while the drawing is live.

There are two records here. The approved drawing is the validated record; it lives in your DMS, and we never claim to hold it. The working revision (the one moving between you, your client, and your vendors as it changes) has never had a home of its own. That is the record we keep: one live document, every change attributed, so everyone knows which version is current.

Under ISPE GAMP 5, PharmaDiagrams is a Category 1 authoring tool: qualified, not validated. The diagrams it produces are GxP-relevant artefacts that you validate downstream, inside your own document control. It is not a 21 CFR Part 11 record-holder for the approved record: your validated DMS (Veeva Vault, ValGenesis) keeps that, and your plant CAD keeps the engineering master. For your QMS, a Category 1 tool is usually a short supplier assessment; we provide a vendor compliance package (our development lifecycle, change control, and security controls) on request. The full category reasoning, written to go in your assessment, is on the GAMP Category 1 page.

What PharmaDiagrams is not

“Validated for GxP.”
A 21 CFR Part 11 record-holder for your approved drawings.
A replacement for your validated DMS (Veeva Vault, ValGenesis).
The engineering master. Your plant CAD keeps that.

Data and privacy

Your data stays in the EU.

Hosted in the European UnionYour drawings, version history, and audit trail are stored in the European Union.
An Irish company, an EU processorBlynksolve is incorporated in Ireland; the Irish Data Protection Commission is our lead supervisory authority. We process your data as a processor, on your instructions.
DPA on requestA data processing agreement covering GDPR Article 28 is available on request.
Sub-processors, disclosedA current list of our sub-processors is available on request, and we give notice before it changes.

The record

A living record built for review.

Attributed and timestampedEvery edit, comment, and approval is timestamped and linked to a verified user.
Tamper-evidentEach version carries a hash, chained so that any later change to an earlier version is detectable.
Lock freezes a revisionWhen you lock a revision it freezes; the next change starts a new one.
Enterprise sign-offEnterprise adds electronic signatures for formal sign-off, with a 21 CFR Part 11-aligned audit trail behind them, and audit-log export for your own records.

Access

Nothing to install.

Browser-onlyThe full editor, the symbol library, sharing, comments, and version history all run in a modern browser. No install, no admin rights, no IT ticket.
EncryptedYour data is encrypted in transit and at rest.
Single sign-on for EnterpriseToday, sign-in is by email and password. Enterprise rollouts add SAML/OIDC single sign-on and SCIM provisioning, set up during onboarding.

Sharing

Who can open a drawing.

A drawing is private by default. Sharing a link does not make it public: it points the people you have authorised at the live drawing, and no one else can open it.

Private by defaultA new drawing is reachable only by the people you grant access to. It is not visible to the rest of your organisation by role alone.
Access is per person, by roleEach person gets view, comment, or edit. Grants and revocations are recorded in the audit log.
Public share links are read-only and time-boundedA public share link grants read-only access, is signed, and expires (seven days by default, thirty at most). You can revoke it at any time, with immediate effect.
Links can require a verified identityYou can mark a link so the recipient must verify their email, or sign in, before the drawing loads. Available on every plan, including Free.
Every open is loggedEach open of a shared link is recorded with its time, and with the viewer's identity when the link requires one.

Portability

Your work stays yours.

Export any drawing as a PNG to share, or as a JSON file that imports straight back into PharmaDiagrams with no loss. You can take your drawings with you at any time, and your exported files stay readable on their own.

What we are still building

What is not ready yet.

We would rather tell you now than surprise your auditor later.

SOC 2A SOC 2 examination is on our roadmap, not yet complete. Ask us where it stands today.
Visio importVisio (.vsdx) import is available in beta. It maps common pharma stencils to ISA-5.1 and ISO 10628 and flags anything it does not recognise, so you can check it. Treat it as beta: review an import before you rely on it, and tell us about any stencil it misses.

Disclosure

Found a security issue?

We run a coordinated vulnerability disclosure process and welcome reports from security researchers and customers. Email contact@blynksolve.com, or find the machine-readable contact at /.well-known/security.txt (RFC 9116).

Good-faith research is welcomeReport in good faith — access only what you need to show the issue, avoid privacy violations and service disruption, and give us time to fix it — and we will treat your research as authorised and will not pursue legal action.
What to expectWe acknowledge reports within three working days, then triage and remediate on a severity-based timeline, criticals first. We work to coordinated disclosure and are glad to credit you once an issue is resolved.

Doing a vendor review?

Send this page to whoever needs it. For a vendor compliance package, a DPA, or a security questionnaire, talk to us. We answer in plain terms.

Talk to us about a review Request a demo