Per-tenant data isolation
Tenant access controls scope customer workspace records to the authorized account. Review the tenancy model and the controls relevant to your intended use.
Trust center
Confidence starts with clear answers.
Review access controls, approval history, hosting and the evidence your team needs. Explore each area below, or request a walkthrough around your requirements.
Shipping today
Security & architecture
The platform is multi-tenant PostgreSQL with isolation enforced in the data layer, served over HTTPS.
Hashed credentials
Passwords are stored only as salted PBKDF2/bcrypt hashes. Azora never stores or logs a plaintext password.
Two-factor authentication
TOTP-based 2FA, with a per-tenant policy that lets an administrator enforce 2FA for every user in the tenant.
Encrypted stored secrets
Stored secrets such as TOTP seeds and API keys are encrypted at rest with AES-256-GCM.
Transport encryption
All traffic to the hosted platform runs over HTTPS.
Deeper reading
The full posture, no NDA: security overview and architecture brief.
Shipping today
Data integrity & approval records
Records that carry regulatory weight use e-signatures with re-authentication, a stated meaning and a tamper-evident audit trail. Review these controls against your intended use.
Signature ceremonies with re-authentication
Signing a controlled record includes re-authentication at the moment of signature.
Adopted signature manifestations
Each signature is rendered with the signer's name, the date and time, and the meaning of the signature (such as authorship, review, or approval).
Tamper-evident, append-only audit trails
Regulated records keep an append-only history of changes, actors, and transitions, designed so alteration of past entries is detectable.
Server-owned timestamps
Timestamps on signatures and audit entries are set by the server, not by the client machine, so a workstation clock cannot rewrite history.
Record retention gates
Retention rules govern deletion of regulated records. Review the applicable controls for the records your team will use.
See it in the product
Change control with e-signatures is part of the QMS module; the QMS hub maps every quality discipline.
Customer deliverable
Validation
Validation brings your intended use, configuration and procedures together. Prepared requirements and test materials give your team a structured starting point.
GAMP 5 validation package
A GAMP 5 Category 4 package: 299 pre-authored user requirements and 196 executable OQ scripts across 10 functional modules, plus an IQ for the environment, a 21 CFR Part 11 risk assessment, PQ guidance and a Validation Summary Report template. Every OQ document carries its own requirements traceability matrix.
Evidence for your intended use
Your team executes the supplied, unexecuted OQ scripts against its configuration and procedures, with implementation support from Azora. Providing the software or templates does not establish validated status or regulatory approval.
Ask for it
Evaluating Azora and want to review the package structure first? Email us.
Operational practice
Reliability
Review the stated operational practices and the supporting records relevant to your deployment.
Backup and recovery procedures
Encrypted off-box backup and restore steps are documented in our operations runbooks. Ask for current execution evidence during a security review.
Tested recovery
Restore steps are documented in our operations runbooks and exercised as a drill. A recorded drill on 2026-09-09 restored the full production database from an encrypted off-box backup with row counts verified against live.
Self-host option
Enterprise customers can run the same codebase on their own infrastructure and hold the database and keys themselves.
Planned capabilities
Roadmap
Evaluate your requirements against currently available capabilities. Planned items below are separate from what is available today.
SOC 2 readiness
SOC 2 readiness work is on the roadmap. Azora does not hold a SOC 2 report today and does not claim one.
SSO / SAML
Single sign-on via SAML (with SCIM provisioning) is on the roadmap for enterprise tenants. See the changelog and roadmap for status.
Guide
A practical path through quality planning.
An illustrative playbook for a 30-person device startup, from gap assessment to preparing supporting evidence. It connects each stage to relevant Azora modules. The example is educational and is not a customer case study or evidence of regulatory readiness.
Verify it yourself
Bring the questions that matter to your team.
Explore access, approval records and deployment requirements in a focused walkthrough. Share your priorities so we can prepare the relevant material.