Built by a quality engineer. Not by a software company.
Years spent on the factory floor, inside operational quality, and across the table from regulators and notified bodies. The same gaps kept appearing, and none of the tools closed them. Syntax is the attempt to close them.
Early access, open now.
Syntax is in early access ahead of general release. If you want to shape how it works before it is finished, this is the point at which that is possible. ISO 27001 certification is in progress, run through our compliance partner Sprinto — we will publish the certificate when it is issued, and not before.
We would rather state our position plainly at the first meeting than have you discover it at the fifth. If you are evaluating now, talk to us about what deployment would look like for your team.
See whether it fits what you are building.
One system. Eight modules.
All modules share a common data model, creating a single source of truth across your quality system.
One product. One history. Complete traceability.
From concept to withdrawal, Syntax eQMS connects requirements, risks, design controls, quality processes and post-market evidence in a single lifecycle.
Configured on deployment. Amendable under change control, like anything else you control.
↕SELECT A PHASE FOR DETAIL
Your records first. Then curated knowledge.
A general chatbot sends your question straight to a model and hopes. Syntax searches your own records first, then a curated quality and regulatory data bank, and only then asks the model to put an answer in plain words.
See Syntax Regulatory in action.
A modern, intuitive platform built for quality professionals, regulatory teams and product development organisations.
FIG 1SCREENS FROM THE PRODUCT · SAMPLE DATA
Connected processes. Better outcomes.
Faster implementation with pre-configured quality content
Eight fully integrated quality modules
Closed-loop quality and lifecycle management
End-to-end traceability and audit readiness
Reduced compliance risk
Accelerated continuous improvement
Ready to modernise quality management?
One platform. Everything included.
There are no feature tiers, locked modules, or paid upgrades to access core functionality. What changes as you grow is the rate, not the software.
- All eight integrated modules
- Quality Manual, procedures and 100+ templates
- Configured product lifecycle
- AI agent across every module
- 21 CFR Part 11 electronic signatures
- Immutable audit trail
- Unlimited read-and-acknowledge access
- Onboarding and configuration
- Support during implementation
- Data export, at any point, in full
- User type — basic, normal or super quality user
- Authoring your documented system
Yours to own. Ours to support.
Validation of the system for your intended use is your responsibility, as it is with any regulated software. We supply the documentation behind it and work with you through the exercise, so you finish with an installation that stands up under GAMP 5 and CSA principles.
Supplier documentation provided as standard — specification, development lifecycle evidence and release records.
Protocol support through IQ, OQ and PQ, with test scripts you can execute and record against.
Risk-based scope under CSA — effort directed at the functions you will actually rely on at audit.
We do not charge for this support and we do not claim your system is validated because ours is. The distinction matters, and an auditor will look for it.
Licences at reduced cost, or at no cost.
If funding is the only thing stopping you from running a proper quality system, tell us. We issue discounted and free licences case by case — early-stage manufacturers, research groups, academic and translational teams, spin-outs. Ask, and we will give you a straight answer.
Tell us your team size. We will give you a figure.
Six controls. None of them optional.
Every module inherits the same foundations. These are not settings you configure on deployment — they are the floor.
Data residency
Microsoft Azure UK South, with geo-redundant backup retained within the United Kingdom. The architecture is region-portable where your residency obligations differ.
Tenant key separation
Each tenant is encrypted under a discrete key held in Azure Key Vault. A key grant conveys no access to another tenant — separation is cryptographic, not only logical.
Immutable audit trail
Creation, amendment, approval and signature recorded with actor, UTC timestamp and reason. Not amendable through the application, and exportable in full for inspection.
Credential handling
Authentication runs on Microsoft Entra External ID. No password is stored, transmitted or visible to Syntax. Multi-factor enforced on administrator accounts.
Electronic signature
Signature manifestation bound to the record and the revision signed, carrying printed name, UTC timestamp and the meaning of the signature, per 21 CFR Part 11 §11.50.
Encryption and backup
TLS in transit, encryption at rest. Encrypted nightly backup on 35-day retention, consistent with recovery expectations under EU Annex 11.
The agent drafts. A named individual signs.
The question every auditor asks about AI in a regulated system is who is accountable for the output. The answer here is never the software.
Proposal, not record. Output carries no identifier, generates no audit entry, and is discarded without trace if rejected.
Accountability with the person. On acceptance it becomes a controlled draft under that user’s ownership and follows the normal approval and signature route.
Traceable contribution. Every interaction is logged and linked to the record it contributed to, so affected records can be identified if output is ever questioned.
Processing boundary. Models are deployed through Azure AI Foundry in UK South. Your content is processed inside the same Azure boundary as the rest of your data, is not transmitted to OpenAI, and is not used for model training under any circumstance.
Your records. Your property.
- You remain data controller; Syntax acts as processor
- Data Processing Agreement executed before any data is loaded
- Documents, procedures and records remain your intellectual property
- No ownership, licence or derived right asserted over your content
- Your content is never used to train AI models
- Records and audit trail exportable at any point, in full
- Complete export on termination, including signature history
- Tenant data deleted 90 days after termination
- Security questionnaires answered and supplier audits supported
- ISO 27001 certification in progress with compliance partner Sprinto
ISO 27001 certification is being run through Sprinto, our compliance partner. We will publish the certificate when it is issued, and not before.
The questions raised before the others.
Send us your security questionnaire.
Search by name, service or category.
Syntax does not assess, verify or endorse any organisation listed. Inclusion here is not supplier qualification — evaluating and approving a supplier remains your responsibility.
List your organisation. Four fields.
No account, no contact details, no personal data. Pick up to three categories so you appear in the right searches. Checked for legitimacy before publication, normally within one working day.
0 of 3 selected
What we hold. Company name, category, service description and website address. Nothing else — no contact names, no email addresses, no certification records. Syntax does not verify or endorse any entry; qualification remains your responsibility. To amend or remove a listing, contact us.
Missing a supplier you work with?
Send us the detail.
No pipeline. No pursuit.
Three steps, and you decide after each one whether there is a fourth.
We reply by email within one working day, with an initial read on whether Syntax fits what you described.
A demonstration using your process — your numbering, your standards, your workflow. Not a prepared dataset.
A written outline of migration, effort and cost, so you can take it to whoever else needs to see it.
If it is not a fit, we will say so at the first meeting rather than the fifth. An early-stage vendor that wastes your time is worse than one that says no.
Who we are, and in which role.
The rest of this notice sets out the same thing in the detail the law expects.
Syntax Regulatory is a trading name of JP-QRE Ltd, registered in England and Wales, company number 10466095, registered office 17 The Paddock, Harston, Cambridge CB22 7PR.
Contact: admin@syntaxregulatory.com
Two different roles
For website enquiries, JP-QRE Ltd is the data controller. We decide what we do with what you send us, and this notice explains it.
For data inside the platform, the customer organisation is the controller and JP-QRE Ltd is the processor. We act on that customer’s instructions under a Data Processing Agreement, which takes precedence over this notice for anything it covers.
What we collect, and why.
Website enquiries
Our contact form sends the details you enter to us by email. We receive your name, email address, organisation, the regulatory scope and enquiry type you selected, and anything you wrote about your current system.
Why: to reply, and where relevant to discuss whether our software suits your requirements.
Lawful basis: legitimate interests — responding to a business enquiry you initiated. Where discussions progress towards an agreement, the basis becomes steps taken at your request before entering a contract.
Supplier register
The register holds company name, category, service description and website address. These are business details, not personal data. We do not collect or publish the names or contact details of individuals.
Platform accounts
When your organisation subscribes, we hold the name, work email address and assigned role of each user. Authentication runs on Microsoft Entra External ID — we never store, transmit or see passwords.
Why: to give each person access, apply their permissions, and record who signed what.
Lawful basis: performance of the contract with the customer organisation.
Platform activity
The audit trail records who created, amended, approved or signed each record, with a UTC timestamp and reason. This is a regulatory requirement under 21 CFR Part 11 and ISO 13485, not an analytics function. It cannot be amended or switched off.
Website usage
We use no cookies, no analytics and no tracking. Our hosting provider records standard server logs including IP addresses, used only for security and operations.
Your content is your property.
Everything created inside the platform — documents, procedures, design records, quality events, training records and everything derived from them — remains the intellectual property of the customer organisation. JP-QRE Ltd asserts no ownership, licence or derived right over it.
We will never use your content to train AI models, to improve our products, to benchmark against anyone, or for any purpose other than providing the service to you.
AI processing
The AI agent operates inside the platform. Models are deployed through Azure AI Foundry in UK South, within the same Azure boundary as your data. Your content is not transmitted to OpenAI or any other model provider outside that boundary, and is not used for training.
Agent output is a proposal until a person accepts it. The audit trail records the individual who accepted and signed, never the agent.
Where your data is held, and who sees it.
All platform data is held in Microsoft Azure UK South, with geo-redundant backup retained within the United Kingdom. Each tenant is encrypted under a discrete key held in Azure Key Vault.
This website and its contact forms run in Microsoft Azure UK South. Website enquiry correspondence is held within Microsoft services in the United Kingdom and European Economic Area.
We do not transfer personal data outside the UK or EEA.
Who we share it with
We do not sell personal data and we do not share it for marketing.
| PROVIDER | PURPOSE | LOCATION |
|---|---|---|
| Microsoft Azure | Platform hosting, authentication, AI processing | United Kingdom |
| Microsoft (Outlook, Azure) | Email and website hosting | United Kingdom / EEA |
We will disclose personal data where required by law, and will tell you if we are compelled to do so unless the law prevents us.
How long we keep it.
Website enquiries that do not progress: 24 months from last contact.
Enquiries that lead to a commercial relationship: for the relationship and six years afterwards, in line with statutory record-keeping obligations.
Platform data: for the life of the subscription. On termination you receive a complete export including audit trail and signature history; tenant data is then deleted after 90 days.
Supplier register entries: until the organisation asks us to remove the listing.
Note on regulatory retention. Retaining records for the periods your own regulatory regime requires is your responsibility, not ours. Export your data before termination.
Your rights, and how to use them.
You have the right to access your personal data, have it corrected, have it erased, restrict how it is used, object to processing based on legitimate interests, and receive it in a portable format.
Email admin@syntaxregulatory.com and we will respond within one month.
If your data is held in the platform, your own organisation is the controller — direct the request to them, and we will support them in answering it.
You may complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Security
Encryption in transit and at rest. Multi-factor authentication enforced on administrator accounts. Access to production systems restricted to authorised personnel and logged.
If a breach affects you, we will notify you and the relevant supervisory authority within 72 hours, as UK GDPR requires.
ISO 27001 certification is in progress, run through our compliance partner Sprinto. We will publish the certificate when it is issued.
Children
Syntax Regulatory is a professional tool for regulated organisations. It is not intended for anyone under 18, and we do not knowingly collect data from minors.
Changes
We will update this notice when our practices change, and will tell subscribing customers by email at least 14 days before any material change takes effect. The date at the top shows when it was last revised.