ITAR specifically regulates the import and export of defense-related products, data and services that appear on the United States Munitions List. EAR is a parallel regulation that focuses on dual-use items available for commercial sale and government use, appearing on the Commercial Control List. Both are strict regulations aimed at preventing sensitive data from being accessible by foreign nationals, and software providers must structure their applications specifically to achieve this.

FactoryFour is ITAR and EAR compliant, hosting our applications on a separate, compliant server and engaging in best practices to avoid violation.

FDA 21 CFR Part 11, and its sister compliance EU GMP Annex 11, require organizations to implement controls, audit trails, electronic signatures, and documentation for software that processes the electronic data the FDA requires them to maintain. This commonly applies to organizations producing pharmaceuticals, medical devices, biotech and biologics.

FactoryFour has implemented all the necessary administrative and technical procedures to be compliant, and cover IQ (installation qualification) and OQ (operational qualification). FactoryFour Customer Success can provide recommendations to your personnel for PQ (performance qualification) required to incorporate FactoryFour into processes covered by Part 11 or GxP.

Organizations that handle patient protected health information (PHI) in the United States are subject to HIPAA. To be compliant with HIPAA, software applications that handle PHI need to have specific network and process security measures in place, such as encrypting data in transit and at rest. FactoryFour works with manufacturers who fall under these regulations to securely store, send and receive PHI while managing production.

GDPR applies to organizations operating within the EU as well as any organizations outside of EU providing goods or services to the EU. Under GDPR, companies that collect personally identifiable information (PII) such as names, addresses, and more are held liable to protect it from misuse or exploitation. Any PII handled within FactoryFour is secure and compliant under GDPR.