This article assesses the Reshape QC Platform, comprising the High Throughput Imaging Device (HTID), the cloud analysis platform, validated image analysis models and the web-based user interface, against the requirements applicable to systems used to generate, review, and retain electronic records in GxP environment.

This assessment covers the imaging device (HTID), device firmware, the cloud platform (image storage, processing, and result delivery), the validated analysis models, and the user interface used for result review, export, and administration.

Electronic signatures are out of scope for these systems: no signature action exists, and there is no review or approval workflow.

The Reshape Quality platform and HTID device is validated for its intended use through a structured, per-site and per-method qualification approach. Qualification runs through several phases: cloud workspace provisioning, device installation and operation, analysis performance testing, and analysis enablement / plate-sorting configuration. Each phase is executed and signed off as its own controlled record. A full qualification package (IQ/OQ/PQ protocols) is available and can be shared as part of a customer’s own validation dossier.

Records generated by the platform (results, edits, and associated audit trail entries) can be exported in a human-readable format for inspection or transfer to a customer's LIMS or reporting system. The current data retention period is 14 months, but can be extended when required. Records remain accessible and unaltered for the duration of their retention period; nothing in the platform's design causes records to degrade, become unreadable, or be automatically purged before the retention period ends.

Every successful change made by a workspace user through Reshape Quality is recorded in the audit trail. The change and its audit event are committed together as a single operation: if the audit event cannot be recorded, the change itself is not applied — so failed actions and actions that don't result in a change never create a misleading "success" entry.

Audit entry guarantees. Every audit entry:

User activity captured in the Audit Log, visible and searchable in the UI, includes:

What each entry contains: the action performed; the date and time; the user who performed it; the affected resource (user, plate, run, configuration, or other); relevant details such as previous and new values; and a reason, where applicable.

Related changes performed as a single operation are retained together. For example,

deactivating several workspace members at once creates a separate entry for each affected member, while preserving that they were part of the same operation.

The Audit Log focuses on actions attributable to users. Automated processing activity — barcode scanning, image capture, analysis, sorting, and batch processing — is recorded but tracked separately from the user-action Audit Log, and is viewable through the relevant plate and run activity views.

Device heartbeat and connectivity are maintained as a separate stream for operational monitoring, tracking device online/offline status and connection health rather than result or record changes.

Exporting the audit trail. The complete audit history for a workspace can be exported directly from the Audit Log in Excel (.xlsx), CSV, or TSV format. Exports include the displayed descriptions as well as event identifiers, user and subject identities, reasons, operation identifiers, and the complete structured event detail. The export request is itself recorded in the audit trail.

Changes to a workspace's analysis configuration can be made only by authorized Reshape personnel. This includes enabling, disabling, or updating an analysis version, changing AI analysis parameters, and changing plate-sorting configuration. Reshape performs them under its own change control procedures. Configuration changes are recorded in the customer's audit trail.

The audit trail is a permanent, chronological record. No workspace user, regardless of role, can edit or delete an audit entry, and record changes do not obscure previously recorded information, corrections are captured as new entries alongside the original value, not overwrites.

The platform supports two user roles: Administrator and standard user (member), each with a unique user ID and password — no two individuals share a login. Administrators have full platform access, including user management; standard users are limited to day-to-day operational tasks such as reviewing and exporting results.

User roles:

No user, regardless of role, can delete a record. Accounts and results are both handled this way, records are immutable once created.

Deactivating a user takes effect immediately and blocks further access; the deactivated user's historical activity remains fully intact and attributable, it is not removed. Granting or removing Administrator access takes effect immediately and is logged with the same completeness as account creation.

Where a site uses single sign-on (SSO), authentication is managed by the site's own identity provider; it is the site's responsibility to ensure Quality Platform access is appropriately restricted on their end, since the identity provider becomes the primary access control in that case.

Every analysis result is permanently linked to the exact device that generated it, including device serial number, device firmware version, and platform software version at the time of the result. This allows any result to be fully reconstructed and attributed at any point in the future, independent of later changes to the device or software.

Reshape recommends that customers maintain a site logbook recording the operator, date, time, and batch number for each run, so that operator-to-run attribution — tying the physical act of loading and starting a run at the device to a specific user — exists outside the platform in the interim.

Note: native, system-level attribution of run-start to a specific user is planned, which will automate this in place of the logbook.

All data in transit between the customer site and the Reshape cloud platform is encrypted (TLS 1.2 or higher). The platform is hosted on AWS, with data stored in the EU (Stockholm, eu-north-1).

Full detail on disaster recovery measures, including annual internal testing, along with Reshape's SOC 2 report and ISO 27001 certification, is available via Reshape's TrustCenter (https://security.reshapebiotech.com/); access can be requested directly through that page rather than reproduced here, so customers always see the current version.