Trust & Compliance
What pharma QA can expect from a software vendor, precise, regulatory-aware, no marketing speak.
What happens to your molecular structures
This is the first question pharma procurement asks, and it deserves an answer without hesitation. Uploaded structures are drug candidates, the most valuable thing a customer has.
No use for training
Your inputs are processed solely to answer the respective request and are never used to train our own or third-party models. This commitment sits in the data processing agreement, not just on this page. The model providers we use are contractually excluded from it too.
Tenant separation
Every record belongs to an account, and separation is enforced at row level in the database, not only in the application. Access through a foreign account returns no rows, not a filtered view.
EU hosting
Operated in Germany at Hetzner Online GmbH, data held within the EU, no mirroring outside the EU. For enterprise, optionally as a container on your own infrastructure.
Deletion on request
Deleted on request within 30 days, including backup copies within their rotation cycle. After contract end within 90 days. Rights to inputs and results remain entirely yours.
Independent Benchmark (ICLR 2026)
On the peer-reviewed MolecularIQ benchmark (Bartmann et al., Klambauer Lab JKU Linz, ICLR 2026), frontier LLMs score 14 to 41 percent on chemical structure analysis. With CovaSyn MCP attached, the same models reach 76 to 92 percent. Four models, 3,540 verified tasks, 12,540 responses. Symbolic verification against ground truth, no LLM judges.
| Model | Baseline | + CovaSyn MCP | Δ |
|---|---|---|---|
| Claude Haiku 4.5 | 21.18 % | 85.38 % | +64.2 pp · 4.03× |
| Claude Opus 4.7 | 40.75 % | 91.51 % | +50.8 pp · 2.25× |
| OpenAI GPT-5.5 | 22.29 % | 89.92 % | +67.6 pp · 4.03× |
| Gemini 3.5 Flash | 13.68 % | 75.66 % | +61.98 pp · 5.53× |
Source: Bartmann C., Schimunek J., Ielanskyi M., Seidl P., Klambauer G., Luukkonen S. (2026). MolecularIQ: Characterizing Chemical Reasoning Capabilities Through Symbolic Verification on Molecular Graphs. ICLR 2026 (Poster). arXiv:2601.15279. Snapshot: 2026-05-17.
Compliance Posture
| Framework | Status | Note |
|---|---|---|
| EU Annex 11 (Computerised Systems) | Aligned | Audit trail, determinism, access control built-in |
| 21 CFR Part 11 (Electronic Records) | Aligned | Tamper evidence via output hashing, signed audit logs |
| GAMP 5 (Software Category 4) | Configured Product | Configuration only, no custom code at customer site |
| ICH M7 (R2) Mutagenic Impurity | Dedicated Tools | Mutagenicity assessment plus expert review workflow |
| ICH Q1A/E Stability | Dedicated Tools | Arrhenius fit and shelf-life estimation with 95% CI |
| ICH Q12 Lifecycle Management | Readiness | Versioning and change-control pathways documented |
What 'Aligned' actually means here
Three measurable properties, not a marketing label:
Determinism
Tool versions are pinned. Identical input → identical output, reproducible weeks later. No RNG seed drift, no LLM probabilism in the numerical path.
Audit Trail
Every tool call is logged with input, output, tool version, timestamp, and API key ID. Logs are exportable as CSV or JSON.
Tamper Evidence
Output includes a SHA-256 hash. If an audit log entry is modified post-hoc, re-hashing surfaces the change.
What validation means at CovaSyn
- Pro/Max: Software delivers audit-grade outputs. Use-case validation happens at the customer site.
- Enterprise: Validation pack with URS, FS, IQ, OQ, PQ templates. GAMP 5 Cat 4 argumentation included.
- Validation IS what runs at the customer site. That's the regulatory reality, no software ships 'fully validated' at purchase.
What we do NOT claim
- 'GxP-validated' as out-of-the-box property. Validation is a customer process, not a vendor property.
- 'Replaces QA review'. CovaSyn complements QA workflows, does not replace them.
- 'FDA-approved'. Software is not FDA-approved, only devices and compounds are.
- 'SOC 2 Type II certified'. In preparation, not yet certified.
Security questionnaires, pre-filled
SIG Lite and CAIQ v4 are fully answered and available here. Both are generated from a single maintained answer library, so one edit takes effect in both at once. Together they cover most of what a company-specific questionnaire asks. If your procurement insists on their own form, it is filled in one to two hours instead of two weeks.
Data processing agreement with the Art. 32 GDPR technical and organisational measures annex, deletion concept, access concept and incident response plan are provided on request.
Subprocessors
Complete list, each with purpose and processing location. Changes are announced with a right to object.
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting of the platform and the database | EUDeutschland |
| Supabase (Datenbank und Authentifizierung) | Data storage, accounts and login | EUEU-Region |
| Stripe Payments Europe Ltd. | Payment processing and invoicing | EUIrland |
| Microsoft 365 (Exchange Online) | Business email communication | EUEU-Region |
| Anthropic PBC | Language model for the chat assistant in the structure editor and for the interpretation feature in campaign analysis; transmits the structure being worked on, the conversation history and tool results, respectively statistical evaluations | Non-EUUSA (Standardvertragsklauseln) |
| Cloudflare, Inc. | Domain name resolution and upstream network protection | Non-EUUSA (Standardvertragsklauseln) |
| Resend (Plus Five Five, Inc.) | Delivery of system messages such as confirmations and billing notices | Non-EUUSA (Standardvertragsklauseln) |
| Twilio SendGrid | Fallback path for delivering system messages | Non-EUUSA (Standardvertragsklauseln) |
| Trustpilot A/S | Collection and display of customer reviews | EUDänemark |
| Google Ireland Ltd. | Website reach measurement, being replaced by our own measurement | Non-EUIrland (Datenübermittlung in die USA möglich) |
Report a vulnerability
Reports go to security@covasyn.com. We respond to legitimate reports within 5 business days and work with coordinated disclosure, 90 days. The machine-readable version is at /.well-known/security.txt per RFC 9116.
Need the validation pack?
Included in the Enterprise tier. Book a discovery call for a walkthrough.