Your lab software, untouched.
Your compliance, absolute.
Compliance ARMOR wraps unmodified Windows instrument software in a tamper-evident audit layer — hash-chained records, electronic signatures, and a plain-English story of everything that happened. No rewrites. No replacement projects.
Why it exists
Replacing validated lab software is a multi-year project. Wrapping it isn't.
Your instruments run software that was validated once and must not change. ARMOR sits around it — watching, sealing, and proving — so you get a modern Part 11 audit trail without touching the application your lab depends on.
Watch
The agent supervises the unmodified application — every launch, file, signature and screen — from outside, with no code changes.
Seal
Each event is written to a hash-chained, HMAC-signed ledger and timestamped by an external authority. Tampering becomes mathematically obvious.
Prove
A plain-English trail and one-click signed exports turn "trust us" into evidence an inspector can verify independently.
What it does
Five things it does at the bench — every time.
Real behaviours of the system, exactly as they run on the instrument PC.
Launch Lock
The instrument application can only be opened through ARMOR, so no work ever happens off the record.
Audit Trail
A hash-chained record of every action, rendered in plain English — not raw system noise.
Tamper Test
Change one byte of a sealed record and the chain breaks visibly. Integrity you can prove, not promise.
E-Signature
Ed25519 electronic signatures bound to the record and the signer, with a mandatory reason.
Session Trail
Every run reconstructed as a readable story — who, what, when, on which instrument.
Scoped Capture
Evidence snapshots of the instrument window only — never the whole desktop. Privacy by design.
Watch it work — live
Don't read about it. Watch it happen.
Five real behaviours of the system, animated as they run at the bench. One of them you get to break yourself.
Someone double-clicks the EXE
Straight on the desktop, bypassing everything.
Windows itself says no
An ACL deny rule means the program physically cannot start outside ARMOR.
Launch through ARMOR instead
The operator authenticates — a real, accountable person.
Unlocked & supervised
Every action from this second is on the record.
Six sealed events. Go ahead — edit one directly, like an attacker with database access would. See how long it survives.
launched PhenomImageViewer
⛓ 7c2e…a914opened sample_0447.tiff
⛓ a914…f37bsaved result — 12.4 µm
⛓ f37b…08d2reviewed record
⛓ 08d2…4be1approved & e-signed
⛓ 4be1…d90cchain anchor sealed
⛓ d90c…22afA record awaits approval
result_0447.tiff is reviewed — now it needs a signature that means something.
The signer states their intent
Meaning and reason are mandatory — §11.50 demands it.
Password unlocks a private key
Each user owns an Ed25519 key only their password can open.
Sealed into the chain
Anchored to the audit chain — it can never be moved, copied, or detached.
Session started by a.mueller
PhenomImageViewer, supervisedOpened sample_0447.tiff
original sealed to vaultSaved result — 12.4 µm
screenshot capturedReviewed by j.weber, approved & e-signed by s.fischer
reason recordedSession closed · chain anchored
every step above, provableBuilt to be trusted
Engineered like the records it protects.
Questions
Asked by every lab. Answered here.
Does Compliance ARMOR modify our instrument software?
No — that's the entire point. Your vendor software runs exactly as shipped, byte for byte. ARMOR supervises it from the outside: controlling how it launches and recording what happens around it. Your existing validation of the instrument software stands.
What software does it work with?
Any Windows application. ARMOR uses a tiered model: generic capture (process lifecycle, windows, watched-folder file events, clipboard, signatures) works with everything out of the box, and deep per-application adapters can be added for the instruments that matter most.
Where does our data live?
On your infrastructure. The backend is a self-hosted FastAPI + PostgreSQL stack — deploy it on a lab server, in your data center, or in your private cloud. Nothing leaves your control.
How do you prove records weren't tampered with?
Every audit event includes a cryptographic hash of the previous event, forming an unbroken chain. Change anything — even one character, even in the database directly — and verification fails from that point forward. Signatures add a second, per-user cryptographic layer on top. Try it yourself in the Tamper Test.
What about validation documentation?
ARMOR ships with test protocols, execution logs, a traceability matrix, and a documented compliance posture — a running start for your CSV package instead of a blank page.
See your own instrument, wrapped and sealed.
A live walkthrough on your software, with your compliance team in the room. No install, no commitment.