FREQUENTLY ASKED QUESTIONS

Partly - and the part that is missing is the part that lands on you.

Public cloud platforms have been audited by pharmaceutical audit consortia Ingelheimer Kreis, and the major providers publish GxP-adjacent documentation. But compliance is shared. The provider may qualify its own infrastructure; you remain accountable for the quality and risk controls governing how you use it.

Large pharmaceutical companies already have those controls. Most mid-sized, small, and emerging companies do not - and building them is a long, expensive project that has to finish before a single validated application goes live.

Validated Cloud assumes 60–95% of that GxP burden for you. You get a qualified environment and a documented control set your regional regulators recognize, on day one. These inspections can be pre-planned or unannounced. For service providers, we perform the same level of preparation for your customers. 

Hosting and cloud providers are not directly regulated by the EMA, FDA, or MHRA. Your systems are - so we build as though we were.

Our entire quality system is aligned to the applicable EMA, FDA, and MHRA requirements for the role we perform. We monitor those agencies continuously and fold new regulations and guidance into our quality system, which removes that tracking-and-re-alignment burden from yours.

We also contractually tie ourselves to your inspection readiness for every activity we perform - planned or unannounced. We have supported client audits since 2011 and are averaging one EMA, FDA, or MHRA audit per month since 2024, with zero regulatory findings in our history.

If you are a software or service provider, we extend the same preparation to your clients audits.

We've integrated the GLP, GCP, and cGMP regional regulations into our quality system, then mapped our services and infrastructure against them - Part 11 and Annex 11 included - and documented the alignment for both our GxP PaaS offering and our internally validated systems.

These analyses are available to you before you sign anything, and available for inspection at any time. Always conduct a thorough audit before you sign up for any service, including GxP, security, and technology subject matter experts. 

ISO 9001 is general-purpose. It is structured and rigorous, and it can govern the manufacture of almost anything - but it is not written for products that patients depend on.

A GxP quality system adds controls built specifically around patient safety and data integrity: tighter change control, documented and re-verified training, end-to-end traceability, and evidence requirements ISO 9001 does not ask for. Those GxP controls also vary by region.

We hold both, plus ISO 9001 and ISO 27001 certifications and align with ISO 13485. 

Qualification applies to platforms - networks, servers, operating systems, databases. Validation applies to what runs on them: applications, data, and processes.

Qualification is evidenced through Installation and Operational Qualification (IQ and OQ, often combined as an IOQ). Validation additionally requires user requirements and formal acceptance through Performance Qualification (PQ) or User Acceptance Testing (UAT). Validated applications and data must sit on qualified infrastructure - EudraLex Annex 11 states this directly, and the FDA’s data integrity expectations reinforce it.

We hand over infrastructure that is already qualified: network, servers, databases, and supporting platforms. Our IQ/OQ library also covers many common life science software packages. You skip qualification document development entirely and go straight to deployment - which is where day-one ROI comes from.

Hyperscalers give you tooling and enough documentation to run an arms-length risk assessment. Direct audit rights go to a small number of very large customers, and the findings and risk remediation plans from those audits are not published.

With us, the audit trail is yours. Full transparency, full auditability. We deploy fully qualified systems and networks, manage them across their entire lifecycle to international GxP standards, and support your audit defense for every activity we perform.

The economics tend to surprise people. Virtual server pricing is broadly comparable — but with the public cloud you also fund the control development, qualification, and documentation yourself, in time as well as money. We deliver all of it on day one.

Hyperscalers give you tooling and enough documentation to run an arms-length risk assessment. Direct audit rights go to a small number of very large customers, and the findings and risk remediation plans from those audits are not published.

With us, the audit trail is yours. Full transparency, full auditability. We deploy fully qualified systems and networks, manage them across their entire lifecycle to international GxP standards, and support your audit defense for every activity we perform.

The economics tend to surprise people. Virtual server pricing is broadly comparable — but with the public cloud you also fund the control development, qualification, and documentation yourself, in time as well as money. We deliver all of it on day one.

No, but that’s a deliberate decision. Redundant power, cooling, and physical security at scale is its own specialization, so we rent cage space from internationally established operators who run hundreds of facilities and do nothing else. Every location has redundant internet, power, generators, and cooling.

Everything inside our cage is ours: all computer equipment and platforms, with no subcontracted platform services.

In 2023, we expanded into the EU through the acquisition of GxP-Cloud, a Netherlands-based company, and opened new data center locations in Schiphol-Rijk, Netherlands, and Dublin, Ireland.

Our cage spaces are GxP qualified in its entirety, and we qualify, manage, and maintain every platform inside it across its lifecycle. We use the datacenters for power, cooling, and physical security - nothing else.

The datacenter operators cannot reach your data. Everything is encrypted within our cages, and we hold the encryption keys. We monitor cage access, and operators must have our approval before entering.

We host life science intellectual property, patient data for CROs, and confidential research data - material that attracts attention. We design for that.

Physically: our datacenter areas carry no identifying markings, we do not publish locations, and access requires traversing multiple secured gates.

Logically: layered architectural security, current-generation tooling, and specifics we deliberately do not publish. All data is encrypted at rest and in transit.

Because life sciences is our only market, every control maps to the international requirements that apply to regulated systems - not to a general-purpose baseline.

We understand that compliance and security are the two areas of our customers highest concern. Validated Cloud provides two types of security constructs to our customers. 

We provide both FDA Open/Closed types of connections to meet the requirements of our customers. Validated Cloud can be a private extension of your corporate network, a secure island for GxP activities, and/or a public internet network accessible by a defined set of contributors or users. 

Security of our datacenter environments starts far outside of our first controlled perimeter with Distributed Denial of Service protection (DDoS). Only encrypted connections can traverse into our datacenters. 

We monitor security continually for the benefit of all. 

Yes - with or without usage of our platform services.

Installing an application in our environment does not make the application, its data, or the surrounding processes validated. That is additional work, and our domain-expert validation consultants do it. We also provide core quality system SOPs you can adopt and tailor rather than write from scratch.

The goal is straightforward: live, and compliant, as fast as possible.

Validated Cloud’s founders and management team came out of biopharmaceutical and medical device companies, and each had built internal compliant private clouds during the 2010s. We started this because we had already done it the hard way, in-house.

Staff are continuously trained and re-trained on policies, SOPs, and GxP awareness, and we staff 2:1 engineering to quality - an unusual ratio, and the reason our compliance output keeps pace with our engineering output.

That combined experience is what lets us serve emerging biotech and global pharma from the same control set.

Development of the Validated Cloud service began in 2009. We opened for business - audit-ready from day one - in February 2011. In 2023, we added Validated Cloud B.V. in the Netherlands.

We are privately held by people who work in the business every day, with no outside investment and no outside influence. Ownership, management, quality, validation, and engineering all answer to the same directive: protect the client and enhance the client experience.