Regulated industries have a data sovereignty problem that cloud-only quality management vendors cannot solve. Pharmaceutical companies operating under 21 CFR Part 11 need to demonstrate control over their electronic records. Defense contractors cannot place quality data on third-party servers. Medical device companies in the EU face GDPR constraints on where personal data associated with quality records can be processed. Biotechs with pre-submission data have trade secret concerns that make any external hosting a boardroom-level risk discussion.
The result: many regulated companies that could benefit from modern quality management software continue using Excel spreadsheets and shared drives because the available alternatives require surrendering control of their data to a vendor’s cloud.
the Game for
Regulated Companies
Gap
| Consideration | Cloud-Only Vendor (Veeva · MasterControl · ETQ) | Self-Hosted QAtrial |
|---|---|---|
| Data location | Vendor’s data centers — typically US/EU, limited choice | Your data center, cloud account, or server closet |
| Data sovereignty | Dependent on vendor’s hosting region options | Complete control — deploy anywhere, air-gap if needed |
| Network requirement | Internet required for all operations | Fully functional offline / air-gapped with Ollama |
| Infrastructure audit | Vendor’s SOC 2 / ISO 27001 reports — no access | You audit your own infrastructure directly |
| Source code access | Proprietary — no access, ever | Full source under AGPL-3.0 — inspect audit implementation |
| AI data handling | Varies by vendor; may process quality data externally | Server-side proxy only; local Ollama for full isolation |
| License cost | $50,000–$500,000+/year (users + modules) | $0 — AGPL-3.0, no per-user or per-module fees |
| Validation package | Vendor provides documentation (black box) | IQ/OQ/PQ protocols + traceability matrix included in repo |
QAtrial v3.0.0 changes this equation. A single command deploys a complete quality management system on infrastructure the company owns and controls.
One Command, Full Stack
docker-compose upThis starts two containers:
- QAtrial application server — Hono (TypeScript HTTP framework) serving both the REST API and the React frontend as static files. Runs on port 3001.
- PostgreSQL 16 database — With health checks, a named volume for persistent data, and automatic initialization.
The Docker Compose configuration includes:
- Health checks on both containers, ensuring the database is ready before the application attempts to connect.
- Named volumes for database storage (
qatrial-db-data) and file uploads (qatrial-uploads), so data persists across container restarts. - Environment variable configuration via
.envfile for JWT secrets, AI provider settings, SSO configuration, and database credentials. - Static file serving — the multi-stage Dockerfile builds the React frontend, compiles the Hono server, and produces a slim runtime image that serves everything from a single process.
No reverse proxy configuration is required for basic deployment. No external service dependencies. No license key activation. The system is functional within minutes of cloning the repository.
![Express Schedule Free Employee Scheduling Software [PC/Mac Download]](https://m.media-amazon.com/images/I/41yvuCFIVfS._SL500_.jpg)
Express Schedule Free Employee Scheduling Software [PC/Mac Download]
- User-friendly drag & drop scheduling: Simple shift planning interface
- Manage time-off and holidays: Add sick leave, breaks, holidays
- Email schedules to staff: Send schedules directly via email
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
What Runs Inside the Containers
Understanding what is deployed matters for regulated companies that must document their system architecture.
Application container:
- Node.js runtime executing the compiled Hono server
- 60+ REST API endpoints across 21 route groups
- JWT authentication with bcrypt password hashing (12 rounds)
- Prisma ORM v7 managing 15 database models
- Webhook dispatch service with HMAC-SHA256 signing
- Server-side AI proxy (API keys stored as environment variables, never exposed to browsers)
- Static file serving for the React 19 frontend (Vite-built, code-split into 14 chunks)
Database container:
- PostgreSQL 16 with ACID transactions
- 15 data models: User, Organization, Project, Requirement, Test, CAPA, Risk, Evidence, Approval, Signature, AuditLog, Webhook, Integration, and supporting tables
- Append-only audit log table capturing 16 action types
- Referential integrity enforced by Prisma schema
File storage:
- Evidence files stored in a dedicated volume mount
- Accessible via the evidence API endpoints
- Backed up alongside the database volume
DevOps Tools for Java Developers: Best Practices from Source Code to Production Containers
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Air-Gapped Deployment: Local AI with Ollama
Some regulated environments — particularly in defense, certain pharmaceutical R&D settings, and government — operate air-gapped networks with no internet connectivity. QAtrial supports this scenario.
The AI co-pilot is configured via environment variables. By setting AI_PROVIDER_TYPE to openai (Ollama uses the OpenAI-compatible API) and pointing AI_PROVIDER_URL to a local Ollama instance, all nine AI functions operate without any external network calls:
- Test case generation
- Risk classification
- Gap analysis (regulatory standards, ISO 13485, QMSR)
- CAPA root cause suggestions
- Executive compliance brief
- Validation Summary Report
- Requirement extraction
- Requirement quality check
The AI model runs on the same network — or even the same server — as QAtrial. Quality data never leaves the controlled environment. For organizations that cannot use cloud AI under any circumstances, this is not a workaround; it is a first-class deployment option.
AI_PROVIDER_TYPE=openai
AI_PROVIDER_URL=http://ollama-server:11434/v1
AI_PROVIDER_MODEL=llama3:70bregulatory compliance software for regulated industries
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
SSO Integration from Day One
Enterprise deployment requires integration with existing identity infrastructure. QAtrial supports OIDC-based single sign-on with:
- Okta — The most common enterprise IdP in pharmaceutical and life sciences companies.
- Azure AD / Entra ID — Standard for organizations on Microsoft 365.
- Auth0 — Common in technology-forward regulated companies.
- Keycloak — Open-source IdP, often used in self-hosted environments that align with QAtrial’s own philosophy.
- Google Workspace — For organizations using Google’s identity platform.
Configuration requires four environment variables:
SSO_ENABLED=true
SSO_ISSUER_URL=https://your-idp.example.com
SSO_CLIENT_ID=your-client-id
SSO_CLIENT_SECRET=your-client-secretQAtrial performs OIDC discovery (.well-known/openid-configuration), redirects to the IdP for authentication, exchanges the authorization code for tokens, and auto-provisions the user on first login with a configurable default role. No manual account creation needed. User deprovisioning follows the organization’s existing IdP processes.
The “Sign in with SSO” button appears on the login page only when SSO is configured, keeping the interface clean for deployments that use local authentication.
UbiBot GS1-AETH1RS Ethernet & WiFi Temp/Humidity/Illumination Sensor, Data Logger, External Probe, Scheduled Reports, Multiple Alert, Support Local Deployment (2.4GHz WiFi & Ethernet, No Hub Required)
- High-Quality Swiss Sensors: Accurate temperature, humidity, and light monitoring
- Customizable External Probes: Supports air/soil temperature, PT-100, CO2
- Wide Measurement Range: -4°F to 140°F, 0% to 90% RH, 0.01-157K lux
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Comparison: Self-Hosted QAtrial vs. Cloud-Only Alternatives
The established quality management vendors — Veeva Vault Quality, MasterControl, ETQ Reliance, Trackwise — operate exclusively or primarily as cloud SaaS platforms. This model works for many companies, but creates specific challenges for regulated organizations:
| Consideration | Cloud-Only Vendor | Self-Hosted QAtrial |
|---|---|---|
| Data location | Vendor’s data centers (typically US/EU) | Your data center, your cloud account, or your server closet |
| Data sovereignty | Dependent on vendor’s hosting region options | Complete control — deploy anywhere |
| Network requirement | Internet required for all operations | Fully functional offline / air-gapped |
| Audit of infrastructure | Vendor provides SOC 2 / ISO 27001 reports | You audit your own infrastructure |
| Source code access | Proprietary, no access | Full source code under AGPL-3.0 |
| Customization | Configuration within vendor’s framework | Modify source code as needed |
| License cost | $50,000-500,000+/year depending on users and modules | $0 |
| Vendor dependency | Vendor controls updates, pricing, and continued operation | Community-maintained, fork if needed |
| AI data handling | Varies by vendor; may process data externally | Server-side proxy; local AI option with Ollama |
| Validation | Vendor provides validation documentation | Validation package included (IQ/OQ/PQ) |
The trade-off is real: cloud vendors provide managed infrastructure, support contracts, and implementation services. Self-hosted QAtrial requires IT capacity to maintain the deployment. But for organizations where data sovereignty is non-negotiable, the choice is between a self-hosted solution and no solution at all.
Total Cost of Ownership
License cost: $0. AGPL-3.0. No per-user fees. No module fees. No annual renewals.
Infrastructure cost: A QAtrial deployment with PostgreSQL runs comfortably on a server with 4 CPU cores, 8 GB RAM, and 100 GB storage. On AWS, this is approximately $150-300/month for an EC2 instance with EBS. On-premises, it runs on hardware most IT departments already have.
Deployment cost: A competent DevOps engineer can deploy QAtrial in a day. The Docker Compose file handles orchestration. SSL termination via a reverse proxy (nginx, Traefik, Caddy) adds another hour.
Maintenance cost: PostgreSQL backup (automated via pg_dump or cloud snapshot), Docker image updates when new versions are released, SSL certificate renewal. Estimated: 2-4 hours per month of IT time.
Validation cost: IQ/OQ execution using the provided protocols. Estimated: 2-3 days for a validation engineer to execute and document.
Year-one total for a 50-user deployment: approximately $5,000-10,000 in infrastructure and labor. Compare this to six-figure annual license fees for commercial alternatives.
Production Hardening Checklist
For regulated deployments, the following steps are recommended beyond the basic docker-compose up:
- Change the JWT secret — Set a strong, unique
JWT_SECRETin the.envfile. - Configure HTTPS — Place a reverse proxy (nginx, Traefin, Caddy) in front of QAtrial with a valid TLS certificate.
- Enable SSO — Configure OIDC to integrate with the organization’s identity provider.
- Set up database backups — Automated daily pg_dump or volume snapshots, with tested restoration procedures.
- Configure AI provider — Set server-side AI environment variables. Use Ollama for air-gapped deployments.
- Execute IQ/OQ — Run the provided validation protocols and document the results.
- Network segmentation — Place QAtrial on an appropriate network segment per the organization’s security architecture.
- Monitoring — Use the
/api/statusendpoint for health monitoring. It reports version, uptime, database connectivity, AI provider status, storage health, and available memory.
Conclusion
Docker deployment transforms QAtrial from a development tool into a production quality management system. Regulated companies gain a validated, traceable, auditable quality workspace that runs on infrastructure they control, connects to identity providers they manage, and uses AI models they choose — including models that run entirely within their network.
The barrier to entry for enterprise-grade quality management has dropped from a six-figure procurement exercise to a single command.
QAtrial v3.0.0 is available at https://github.com/MeyerThorsten/QAtrial.
