What we don't do yet.

MESvantage runs in production at Croom Medical, an ISO 13485-certified, FDA-registered orthopaedic implant manufacturer. Croom is also the company the founder runs. That is a real conflict of interest and we would rather you heard it from us. What it buys you is that the system was built under audit conditions by the people who had to pass the audit. What it does not buy you is a second reference, and we will not pretend otherwise until there is one.

Every line of this system has been exercised on one site. Multi-site tenancy, cross-site reporting and site-scoped permissions exist in the data model and have never been run in anger. If you are a multi-site group, we are the wrong supplier this year.

None has been commissioned yet. When one is, we will publish the summary letter here including findings, whether or not they are flattering. Until then, treat our security posture as untested by anyone outside the company.

We hold neither. If your supplier approval process requires one as a gate rather than as a risk input, we will fail it, and you should not spend a call finding that out.

The production dashboard, work orders and several quality counters query the ERP directly rather than a mirror. That is deliberate — it means you are never looking at a stale copy — but it also means those screens are empty in a demonstration environment with no ERP behind it, and we will not seed them with invented jobs to make a screenshot look better. When you see those screens, they will be showing your data.

Scanner input is implemented but disabled pending hardware qualification. Operators key identifiers today. If scanning is load-bearing for your floor, this is a date to write into the contract, not a feature to assume.

The governed AI layer is deployed but dark by configuration. It stays dark until an evaluation set passes, a signed condition-of-use memo exists, and an e-signed model-release gate is built — the last of which is not built. We would rather ship it late than ship an ungoverned model into a regulated record.

It installs and it works. It is not a native application, there is no offline record capture, and a floor terminal is still the right device for signing.

We have real connectors to a specific ERP, specific CMM output formats and specific machine controllers. Anything outside that list is a scoped piece of engineering with a price and a date, not a checkbox. Ask before you assume, and we will tell you which of your machines can be read on day one and which need a cable.

Under ISO 13485 §4.1.6 and the FDA QMSR, validating software for its intended use in your quality system is your obligation as the manufacturer. It cannot be discharged by a supplier, and any vendor implying otherwise is describing a liability transfer that does not exist. What we can do is hand you the package — requirements, traceability, test protocols and executed evidence — so the exercise is a review rather than an archaeology project. The work is still yours.

The FDA does not validate, certify or approve software products at all — there is no such programme, for us or for anyone. This website used to imply otherwise. That was wrong, we removed it, and the build now refuses to compile if anyone puts that phrasing back. If a supplier tells you their system carries an agency endorsement, ask them which one and who issued it.

The test cases and the requirements trace were executed and signed inside Croom. Croom has been externally audited with the system in scope, but no third party has been engaged specifically to review the validation package itself. Two of the figures we quote for it are still marked as evidence-pending on our own evidence page, because the artefacts have not been assembled for publication.

A continuously-deployed system inside a validated environment needs a release classification, a GxP impact assessment per release, defined regression triggers, and a customer notification lead time with a right to defer. We operate this today. We have not yet published the document, and until we do you should treat our answer as unverified.