Quality Records¶
A controlled document tells you how to do something; a quality record proves you did it. The Quality Records module captures that evidence — in two shapes. Some evidence is a form you fill in inside QStack, like a cleaning log. Some evidence arrives as a file from outside QStack, like a supplier's Certificate of Analysis. QStack treats both as first-class records with the same governance: signatures, audit trail, retention, and search.
You'll use this module if you're an Originator creating a record, a Reviewer or Approver signing one off, or anyone reading existing records during an audit or investigation.
The two sources of records¶
| Internal form record | External document record | |
|---|---|---|
| Source | A form template defined in QStack | A file you upload from your computer |
| The record itself is | The structured data you enter | The uploaded file — the metadata just describes it |
| Search | By form fields and free text | By metadata and by text extracted from the file (native text or OCR for scans) |
| Tamper detection | Enforced server-side | File hash captured on upload, re-verified on download |
| Signatures | Same e-signature flow with a declared meaning | Same |
| Example | "Cleaning log for Mixer-01, dated 2026-06-03" | "Vendor CoA for raw material lot ABC-1234" |
Record types¶
Each tenant works from a library of record types, each backed by a template. QStack ships a starter set that your Quality team can edit or extend:
| Starter template | Source | Purpose |
|---|---|---|
| Equipment Cleaning Log | Internal form | Daily/per-batch cleaning evidence |
| Equipment Use Log | Internal form | Who used what, and when |
| Calibration Record | Internal form or external upload | An in-house calibration entry, or a vendor calibration certificate |
| Vendor CoA | External upload | Material certificate per lot |
| Vendor CoC | External upload | Material conformance per lot |
| Training Record | Internal form | Captured by Training, exposed here for cross-search |
| Deviation Log Header | Internal form | Lightweight entry that may escalate into Deviations & CAPA |
| Visitor Log | Internal form | Site visitor register |
| Lab Notebook Page | External upload | Scanned page from a paper lab notebook |
| Generic Document Record | External upload | The catch-all when nothing else fits |
A record type can be internal-form, external-upload, or either. Each type declares which signature meanings are required — for example, a Cleaning Log requires Performed the work, while a CoA requires Reviewed and approved.
Template versions are pinned
Every record type's template is versioned, and each record pins the exact template version it was created under — it renders against that version forever, even after the template changes. A template is itself governed as a Form controlled document (see Quality Documents): editing its fields means issuing a new Form revision through the normal document lifecycle. Records already in flight keep their pinned version.
Fill an internal form record¶
- Click New Record and pick a record type.
- Fill in the fields. QStack auto-fills server-side values — date, person, tenant — and disables them so you can't edit them.
- Click Submit. The record moves to In Review (or straight to Approved if the type has no review step configured).
- Reviewers and approvers sign with their declared meanings.
- The record moves to Closed and becomes read-only.
Upload an external record¶
- Click Upload External Record and pick a record type.
- Drag or select the file. QStack automatically:
- Computes a SHA-256 hash and stores it
- Extracts text from PDFs and DOCXs so it's searchable
- Runs OCR (Tesseract) on scanned or image files so their content is searchable too — the original file and its hash are never modified; the OCR text is stored alongside it
- Generates a PDF preview if the file isn't already a PDF
- Fill in the capture-metadata form — for a CoA, that typically means lot number, issued date, material code, and vendor.
- Click Submit. The record moves to In Review.
- A reviewer signs — typically with meaning Reviewed and approved or Verified the information — confirming the upload is authentic and complete.
- The record moves to Closed.
Tip
Most early-stage pharma operations rely on contract manufacturers, contract labs, calibration vendors, and raw-material suppliers whose evidence arrives as PDFs, scans, and emailed attachments. You don't have to transcribe that evidence into a form — upload it as-is and QStack still makes it searchable and signable.
Record states¶
Open → In Review → Approved → Closed, with a separate Cancelled state reachable only from Closed.
A record can't move backward except through Cancel with justification, which freezes the record as Cancelled. Cancellation requires a Quality role signature and a written justification, both preserved in the audit trail. If a replacement record is created, it can be linked to the cancelled one.
Link records to documents and to each other¶
Every record can be linked to one or more controlled documents — the SOP it executes against. Records can also link to other records, deviations, CAPAs, and audits, building out the investigation trail an inspector will want to follow.
Search for records¶
The search bar queries:
- Record number, type, and originator
- Form field values, for internal records
- Capture metadata, for external records
- Text inside the uploaded file — PDF and DOCX text extraction, plus OCR text for scanned or image uploads
- Linked documents, deviations, CAPAs, and audits
Examples of what you can search for:
- "Show all Vendor CoAs for material RM-1234 in 2026" — uses metadata
- "Show every record that mentions endotoxin in the free text" — uses full-text search across uploads and form fields
- "Show every record linked to SOP-0042" — uses the linkage graph
What an inspector sees¶
When asked to show evidence that a specific batch was made under your controlled procedure, QA filters records by batch number, lot, or date range. The inspector sees the full list — cleaning logs, equipment logs, CoAs, calibration records, both internal and external — each with its state, signatures, and linkages. Clicking any record renders the file or filled form with signatures visible: names, dates, meanings, and the authentication method used.
Tenant configuration¶
A few things about how this module behaves are set once for your whole organization, typically during onboarding:
- Which starter record types to keep, edit, or remove
- Which custom record types to add, and whether each is internal-form, external-upload, or either
- Required signature meanings per record type
- Retention period per record type (default: 10 years)
What this module doesn't do¶
- It doesn't generate paper barcoded forms — if you need offline capture, print the form PDF and upload the filled, scanned copy as an external record.
- It doesn't turn scanned forms back into structured data. OCR makes scanned uploads searchable, but it doesn't populate form fields from a scan — you still fill in the metadata form yourself.
- It doesn't connect directly to lab instruments — instrument exports land as external-document records through manual upload.