Software information & data handling
CopperBear systems are designed for non-GMP operational records: EHS incidents and investigations, COSHH assessments, general training and non-GMP asset management alongside an organisation’s QMS. These browser-based applications do not replace a validated GMP CMMS, eQMS or GMP electronic training system. The information below describes how the current versions operate.
Where the software runs and records are stored
| Area | Current arrangement |
|---|---|
| Application hosting | The current CopperBear web deployments are hosted on Netlify. Netlify delivers the application files to the browser. This does not mean the operational register data is stored in a Netlify database. |
| Operational records | Records are saved primarily in the user's browser using local storage. Modules with document attachments also use browser-based IndexedDB storage where supported. Browser records are specific to that browser profile and device and can be lost if browser data is cleared or the device fails. |
| Shared registers | CMMS, SHEIR and COSHH support file-based shared registers. Connecting a managed shared folder is a mandatory CopperBear installation and go-live step, not an optional add-on. An authorised user must select and grant browser access to the folder in compatible desktop Edge or Chrome; the application cannot select or authorise a folder automatically. A folder synchronised by the customer through OneDrive or SharePoint can be used, subject to its permissions and sync behaviour. This is not a direct Microsoft Graph database integration. The current Training Matrix has no live shared-folder connection and instead supports local records plus JSON export/import; it must have its own controlled export and recovery procedure and should not be the sole authoritative multi-user training register. |
| Data location | Locally saved records reside on the user's device. Where a shared or backup folder is configured, copies are stored wherever that folder and its optional cloud-sync service are configured to store them. A UK-only residency guarantee is not built into the applications. |
| Backups & restoration | CMMS, SHEIR and COSHH include export and restore tools and support automatic file writes where a user has configured and authorised them in a compatible browser. As part of installation, the shared-register write must be checked and a separate, versioned backup and a test restoration must be verified before go-live. File synchronisation alone is not a backup against accidental deletion, corruption or overwrite. Attachments may require separate export and recovery checks. The Training Matrix relies on controlled JSON exports and independently retained backups. There is no centrally managed CopperBear cloud backup service. |
| Access controls | Access to a deployed application can be restricted at the website level, and access to shared files is governed by the selected folder's permissions. The current modules do not provide a common centrally managed, individually authenticated, role-based user system across the entire suite. |
| Change history & audit trail | Some workflows record amendments, dates, status changes or document revisions; for example, CMMS retains work-order amendment history. There is no comprehensive, tamper-evident electronic audit trail for every record creation, edit and deletion across all four products, nor a validated electronic-signature facility. |
Practical consequence: clearing browser data, changing browser profiles or losing a device can remove its local records. For CMMS, SHEIR and COSHH, shared-folder access and a successful recovery test are go-live conditions. If synchronisation or folder permission fails, stop and resolve the issue rather than relying on the local browser copy as the only incident or safety record.
Required setup before a system goes live
CopperBear carries out and documents these steps as part of every installation.
- Agree the record owner and scope. Identify which records are non-GMP and which must remain in the customer’s approved QMS or other validated system.
- Connect the shared register. For CMMS, SHEIR and COSHH, use supported desktop Edge or Chrome, select the customer-managed shared folder, and confirm the correct register is opened on each authorised workstation.
- Verify every write and read. Create an identifiable test record, confirm that it appears in the shared file and on a second authorised workstation, and test what happens after a browser restart.
- Secure an independent backup. Configure an appropriately protected and versioned backup with its own retention settings; verify that records and attachments can be restored after simulated loss of local browser data.
- Document acceptance. Capture the owner, file location, permissions, restore evidence and date. If shared access or recovery fails, the deployment is not ready for live records.
Training Matrix exception: the current version has no shared-folder feature. Until that is developed, use it only with a documented export/backup arrangement appropriate for non-GMP records. Do not represent it as providing automatically synchronised or centrally controlled training evidence.
GMP electronic records and validation
No blanket claim of compliance with EU GMP Annex 11 or 21 CFR Part 11 is made for these applications. Suitability for use in a GMP-regulated process depends on the intended use, configuration, access controls, audit trails, validation evidence, procedures and the customer's quality system. A documented, risk-based assessment is necessary before treating records as GMP electronic records.
Discuss an implementation
For a demonstration or to discuss how one of the systems would be hosted and maintained for your organisation, email alan@copperbear.co.uk or book a discovery call.