Custom Software for Pharma & Biotech
Secure, flexible, and compliant architecture tailored for the unique challenges of the Pharma & Biotech sector.
Vivek Mishra — Founder & Lead Architect, ERPStack
Quick Answer
In short: a biotech ERP is a validated system, not just a database. ERPStack builds custom biotech and pharma software to 21 CFR Part 11 and EU GMP Annex 11: ALCOA+ audit trails that cannot be quietly edited, GAMP 5 Second Edition risk tiers, and validation effort scoped by FDA's 2025 final Computer Software Assurance guidance.
Why Custom ERP for Pharma & Biotech?
Operating in the Pharma & Biotech sector requires a systems architecture designed for high scalability, operational flexibility, and strict regulatory compliance. Standard off-the-shelf software forces your teams to reshape their workflows to fit rigid software packages. A custom ERP for the Pharma & Biotech industry maps directly to your exact business logic. Deployed to your secure cloud infrastructure (AWS or Azure), the system isolates database schemas, automates redundant reporting tasks, and scales without user seat licensing fees. This ensures your corporate data remains under your absolute control, eliminates vendor lock-in, and lowers long-term operational technology costs by up to 70% over a 3-year period.
Industry Pain Points
- LIMS, ELN, MES and the ERP each hold a different batch identity, reconciled by hand
- 21 CFR Part 11 audit trails bolted on after go-live, so validation restarts
- Every release re-runs full CSV scripts because nothing separates product-quality functions
- Data corrections that overwrite the original entry instead of superseding it
- DSCSA serialisation exported as CSV rather than as GS1 EPCIS 2.0 events
- One retention policy for GLP raw data, cGMP batch records and clinical documents alike
Engineering Blueprint
Biotech is not patient care, it is regulated product development and manufacture — so the binding artefact is a validated record, not a chart. ERPStack reads ALCOA+ as a PostgreSQL schema specification rather than a poster, and grows the biotech ERP outwards from it.
ALCOA+ is a column list
MHRA’s GxP data integrity guidance spells it out: attributable, legible, contemporaneous, original, accurate, plus complete, consistent, enduring and available. Every word is a constraint. 21 CFR 11.50(a) demands the signer’s printed name, the time executed and the meaning of the signature; 21 CFR 58.130(e) demands a change never obscure the original entry and always carry a reason. In Drizzle ORM that is columns and PostgreSQL triggers, settled before the first biotech migration — not a Technical Debt item for validation week.
// Drizzle ORM on PostgreSQL — 21 CFR 11.50(a) signature manifestation
export const batchRecordSignatures = pgTable('batch_record_signatures', {
batchId: uuid('batch_id').notNull(),
signerPrintedName: text('signer_printed_name').notNull(),
executedAt: timestamp('executed_at', { withTimezone: true }).notNull(),
meaning: text('meaning').notNull(), // review | approval | authorship
supersedes: uuid('supersedes'), // correction, never an UPDATE
reasonForChange: text('reason_for_change'),// 21 CFR 58.130(e)
gxpScope: text('gxp_scope').notNull(), // GLP | GCP | cGMP
});ICH E6(R3) hands you the data lifecycle
ICH E6(R3), adopted 6 January 2025, promoted data governance into its own Section 4, and Section 4.2 enumerates what a biotech system must implement: capture, relevant metadata including audit trails, review, corrections, transfer and migration, finalisation before analysis, retention and access, destruction. That is a state machine. ERPStack models it as append-only PostgreSQL rows with supersede semantics in Drizzle ORM, so a correction adds a row and the original survives — what EU GMP Annex 11 clause 9 expects of audit trails and clause 12.4 of operator identity.
One batch identity across LIMS, ELN and MES
In most biotech estates the LIMS, the ELN, the MES holding electronic batch records, the QMS carrying deviations, CAPA and OOS investigations, and the ERP each hold a different idea of a batch. ERPStack fixes one canonical batch identity in PostgreSQL and lets the rest reference it over a REST or GraphQL API with Zod-validated payloads. A CRO adds a second axis: sponsor separation is a Multi-tenant Architecture question answered with Row-Level Security and per-sponsor keys. SAP S/4HANA, Oracle NetSuite and Microsoft Dynamics 365 are strong on the financial half, weak on the GxP half — so the honest route is the Strangler Fig Migration Pattern: biotech quality records first, costing last.
Serialisation and cold chain are event stores
DSCSA package-level traceability is not a CSV. GS1 EPCIS 2.0, ratified June 2022, models the what, when, where and why of each commissioning, aggregation and shipping step; ERPStack ingests them as an Event-Driven Architecture on Apache Kafka with Idempotency in API Design keyed on the event identifier, so a replay cannot double-ship a pallet. Cold-chain probe readings go to TimescaleDB, the excursion verdict to PostgreSQL, and Next.js and TypeScript screens read both — so a biotech recall and a partner’s EPCIS document resolve from the same rows.
Our Solutions
- 21 CFR 11.10(e) audit trails as PostgreSQL triggers, written before the first feature
- ALCOA+ mapped to columns: printed name, executed timestamp and signature meaning per 11.50(a)
- GAMP 5 Second Edition risk tiers driving Vitest and Playwright suites in GitHub Actions
- ICH E6(R3) Section 4.2 data lifecycle as supersede-never-update rows in Drizzle ORM
- GS1 EPCIS 2.0 capture for DSCSA and UDI records for the FDA GUDID under 21 CFR 830
- Row-Level Security separating identifiable trial data from de-identified research extracts
Compliance & Security
Biotech compliance is never one framework. Validation, GxP scope, device quality and human-subject data protection each impose a different obligation on the same PostgreSQL tables.
FDA 21 CFR Part 11 compliance, at the schema level
11.10(e) requires secure, computer-generated, time-stamped audit trails recording operator entries that create, modify or delete records, never obscuring earlier values, retained at least as long as the record. A closed system under 11.3 is one where access is controlled by the people responsible for the content — an RBAC, SSO and Zero-Trust Security statement, not a firewall one, with re-authentication state in Redis and short-lived JWT claims. ERPStack makes that Immutable Audit Trail a PostgreSQL trigger, so no biotech hotfix can switch it off.CSA is final, and it changes the test plan
FDA’s Computer Software Assurance guidance went final on 24 September 2025 (90 FR 45945, docket FDA-2022-D-0795) after three years as a 2022 draft, and GAMP 5 Second Edition (ISPE, July 2022) already asked for critical thinking by experienced SMEs over script volume. For biotech that means risk-tiered assurance: Vitest and Playwright suites plus Semgrep SAST in GitHub Actions aimed at the functions reaching product quality, unscripted testing on the rest, and evidence emitted by the pipeline with Sentry holding the production error record.Retention is per-GxP, not per-company
The clocks differ, so the schema has to know which applies. 21 CFR 211.180(a) keeps a batch record one year past the expiration date, or three years after distribution for certain OTC products. 21 CFR 58.195 archives GLP raw data for the shortest of two years after approval or five after submission. 21 CFR part 820 became the QMSR on 2 February 2026, incorporating ISO 13485:2016 by reference, with unique device identification under part 830 feeding the FDA GUDID. ERPStack drives biotech retention from a policy table, not a cron job.Human-subject data, where biotech diverges from healthcare
GDPR Article 9(1) prohibits processing genetic and health data outright; 9(2)(j) reopens it for scientific research only under the Article 89(1) safeguards, which name pseudonymisation explicitly. For secondary use, 45 CFR 164.514(b) offers Safe Harbor — stripping 18 enumerated identifiers — or Expert Determination by a qualified statistician. Neither survives contact with a genome. ERPStack therefore separates identifiable biotech trial data from research extracts using Row-Level Security and separate AWS KMS keys on AWS or Microsoft Azure under Terraform, and keeps EU trials inside the CTIS regime mandatory since 31 January 2025.
Standards we engineer to
- FDA 21 CFR Part 11
- EU GMP Annex 11
- GAMP 5 Second Edition
- 21 CFR Part 58 (GLP)
- ICH E6(R3) GCP
- 21 CFR Part 820 (QMSR)
- GDPR Article 9
Get the Blueprint
Download our comprehensive Systems Architecture Blueprint to see how we architect compliant solutions.
Download BlueprintMetrics & Integrations
Illustrative engineering targets for this sector — the SLAs and capacities we design and build toward, not a live service dashboard.
21 CFR Part 11 audit-trail write overhead
Batch record e-signature round trip
GS1 EPCIS 2.0 event ingest
Validation evidence pack build
Integration: Veeva Vault
Integration: GS1 EPCIS 2.0
Integration: CDISC SDTM / ADaM
Integration: FDA GUDID
Integration: SAP S/4HANA
Integration: AWS KMS
Implementation Process
Validation strategy
GAMP 5 Second Edition risk assessment and CSA tiers agreed before any code is written.
ALCOA+ schema
Attributable, contemporaneous and original mapped to Drizzle ORM columns and PostgreSQL triggers.
Signature manifestation
21 CFR 11.50(a) name, timestamp and meaning rendered on every human-readable record.
GxP interface layer
LIMS, ELN and MES batch records bound to one canonical PostgreSQL batch identity.
Traceability and submission
GS1 EPCIS 2.0 events, GUDID records and CDISC-ready biotech extracts.
Evidence package
IQ/OQ/PQ artefacts, trace matrix and audit-trail review reports exported for inspection.
Frequently Asked Questions
Four concrete things. 11.10(e) requires secure, computer-generated, time-stamped audit trails recording operator entries that create, modify or delete records, never obscuring earlier values, retained at least as long as the record. 11.50(a) requires the signer's printed name, the date and time executed, and the meaning of the signature, all visible in human-readable output. In a biotech build those are columns and PostgreSQL triggers, not a settings page.
Final. FDA announced the final Computer Software Assurance for Production and Quality System Software guidance on 24 September 2025 at 90 FR 45945, under docket FDA-2022-D-0795, three years after the September 2022 draft. For biotech and medical device software that legitimises risk-based assurance: heavy scripted testing where software touches product quality, lighter unscripted testing elsewhere, with the evidence produced by the pipeline.
Buy the specialist systems, build the seam. Veeva Vault, a validated LIMS and an MES with electronic batch records each encode decades of GxP practice that no custom project should re-litigate. What is usually missing in biotech is the connective layer: one canonical batch identity, one audit trail, one retention policy. That seam is where a custom ERP earns its keep, and where SAP S/4HANA is weakest.
Different subject entirely. A healthcare system is built around patient care, HIPAA and FHIR exchange between providers. A biotech system is built around regulated product development and manufacture: GLP studies under 21 CFR Part 58, GCP trials under ICH E6(R3), cGMP batches under Parts 210 and 211, and devices under the QMSR. The record that matters is a batch or a study, not an encounter.
Data governance became its own chapter. ICH E6(R3), adopted 6 January 2025, added Section 4 on data governance and Section 4.2 enumerating the data lifecycle: capture, relevant metadata including audit trails, review, corrections, transfer and migration, finalisation before analysis, retention and access, and destruction. For a biotech sponsor that reads as a system specification, and Section 4.3 addresses computerised systems directly.
Only under a derogation with safeguards. GDPR Article 9(1) prohibits processing genetic and health data; Article 9(2)(j) permits it for scientific research where Union or Member State law provides the Article 89(1) safeguards, which name pseudonymisation explicitly. In practice a biotech platform separates the identifiable trial store from the research store at the schema level, with different keys and Row-Level Security rather than a filtered view.
It is the QMSR. FDA's Quality System Regulation Amendments final rule, 89 FR 7496 published 2 February 2024, took effect on 2 February 2026 and replaced the old subparts with a part that incorporates ISO 13485:2016 by reference at 820.7. Section 820.10 also ties ISO 13485 clauses to unique device identification under part 830 and complaint reporting under part 803, which any biotech device system must satisfy.
By accepting that de-identification does not work on a genome. 45 CFR 164.514(b) offers Safe Harbor, removing 18 enumerated identifiers, or Expert Determination by a qualified statistician — but a variant set identifies a person by construction, so neither route makes it anonymous. A biotech warehouse therefore controls access rather than pretending to anonymise: separate storage, RBAC by protocol, and logged, purpose-bound queries.
Wherever it lives, it must be an event store rather than a report. DSCSA package-level traceability is expressed in GS1 EPCIS 2.0, ratified June 2022, which models the what, when, where and why of each commissioning, aggregation and shipping event. A dedicated platform is a reasonable choice for a large biotech; the failure mode is exporting flat CSV files and losing the event semantics.
Different clocks, which is why one retention setting fails. 21 CFR 211.180(a) holds a batch production record at least one year past the batch expiration date, or three years after distribution for certain OTC products without expiration dating. 21 CFR 58.195 archives GLP raw data and specimens for the shortest of two years after approval or five years after submission. A biotech schema stores the applicable rule per record.