The controls behind a record that’s meant to survive an audit.
Chain-of-custody documentation is only worth as much as its integrity. This is a plain account of how the data is protected, how the application is built, and which regulatory frameworks the design is aligned to — including what is not yet claimed.
Every custody event is hash-chained to the one before it.
Each event record stores a cryptographic hash of its own contents plus the hash of the previous event for that batch. Changing a past event — a time, a location, a signature — changes its hash, which breaks every link after it. The tampering is detectable; it is not a silent edit.
Alongside the chain, a separate append-only audit trail records who did what and when, across the whole organization.
How the application itself is secured
Authentication
- TOTP two-factor authentication, mandatory for admins and pharmacists, opt-in for other roles
- One-time backup codes issued at enrollment for device loss
- Second-factor secrets encrypted at rest with application-level encryption
- Operator reset path for locked-out users, which forces re-enrollment
Application security
- Static analysis (Brakeman) runs on every change in CI
- Dependency vulnerability auditing (bundler-audit) on every change
- Rate limiting on authentication and sensitive endpoints
- Secret scanning on every commit to the repository
Access control & audit
- Policy-based authorization on every action, with per-organization data scoping
- Append-only audit trail of user events, visible on the Compliance screen
- Custody records hash-chained rather than editable
Billing & data handling
- Payments handled by Stripe; card details never touch our servers
- Inbound billing webhooks verified by signature before they are trusted
- Hosted on managed infrastructure with encrypted transport (TLS) throughout
21 CFR Part 11
The custody log and generated packets are designed around Part 11’s expectations for electronic records: attributable, time-stamped, and protected against undetected alteration, with an independent audit trail.
DSCSA
Custody-event logging and per-shipment compliance packets give dispensers an audit-ready record of what happened in transit — the documentation that matters once the small-dispenser exemption ends on November 27, 2026. It does not replace a wholesaler’s serialization system.
Pharma Transport is an early-stage product built and run by a single founder. There is no SOC 2 report or third-party penetration test on file today, and we do not currently sign HIPAA business associate agreements. SOC 2 is on the roadmap; we will start the process when a customer’s procurement genuinely needs it rather than earlier for show. A Compliance Packet is a documentation tool — it is not, on its own, a certification of regulatory compliance. If a formal attestation is a requirement for you, book a call and we’ll be candid about where things stand and how fast we could move.