Soterias · GCP audit intelligence

The audit,
above reproach.

Soterias is an AI‑assisted audit platform for Good Clinical Practice. The assistant reads the dossier, drafts the findings, and cites every clause. The auditor owns every judgment. And nothing — not a document, not a prompt — leaves your infrastructure.

Request a pilot Read the method

Built around ICH E6(R3) and 21 CFR Parts 11·50·54·56·312 — 943 clause-anchored provisions

FND-2026-014 · CONSENT Major

RequirementInformed consent shall be documented by a written form signed and dated by the participant before any study-specific procedure.

ConditionHowever, the consent form for two (2) of the ten (10) sampled participants was signed one (1) day after the first study-specific procedure recorded in source.

E-041 Consent form v3.0, Participant 07 Verified
E-042 Source visit record, 14 Mar 2026 Verified
E-043 Re-consent note to file Not provided

PHRASING · CONTRADICTION — licensed by E-041/E-042

The burden of proof

An audit is an evidence-driven
reconstruction of trial conduct.

Weeks of preparation. Thousands of pages. Protocols and amendments, consent versions, delegation logs, SAE listings, IMP accountability, monitoring reports — condensed into a report that must survive regulatory scrutiny for decades.

The volume

A single site audit spans fourteen review domains — informed consent to computerised systems. Every domain carries its own records, its own requirements, its own failure modes.

The defects

Real audit files contain impossible dates, count mismatches, unresolved placeholders, and contradictions between one SOP’s own pages. Defects hide between documents — where no single reader looks.

The judgment

ICH E6(R3) moves the question from “is it compliant?” to “what is the impact on critical risk?” That answer is professional judgment — and judgment needs evidence assembled, not buried.

The platform

A workbench, not a chatbot.

Soterias is blueprint-driven, not chat-driven: a deterministic workflow spine with an assistant on top. Chat is one surface among many — never the workflow itself.

Pipeline blueprints

Nine stages, sixty-four steps, nine human gates — the whole site-audit pipeline ships as versioned data, validated on load. Vendor and internal audits are configurations, not rewrites.

Three workspaces

Site, vendor, and internal audits — plus pre-inspection readiness — share one engine and roughly 80% of their artifacts.

Typed interactions

Document requests, questions, drafts, gate validations, escalations, feedback — six typed objects, each one a GxP record. Not chat bubbles.

The findings register

Eight-part findings — requirement, condition, quantified extent, evidence, risk, systemic context, ownership. Your severity definitions, printed verbatim.

The skills library

Fifteen assistant skills, from protocol-grounded Q&A to verdict drafting. Each is a prompt pack, an allow-list of tools, an output schema, and an eval set.

Eight of fifteen in service — each shipped only once measured.

The dossier

An eleven-folder controlled audit file; agenda to certificate rendered as DOCX against your templates. The report never reaches the site; the certificate is the only artifact filed to the TMF — routing the platform enforces.

The method

Nine stages. Nine gates.
One auditor in command.

The assistant proposes, asks, and drafts; the auditor uploads, answers, and validates. Every checkpoint is an explicit go / no-go owned by the human — classifications remain professional judgment.

The assistant

— the human gate

The evidence discipline

A citation that does not resolve
is a failed generation — not a warning.

Every draft passes a wall of deterministic validators before an auditor ever sees it. Language is licensed by evidence: a sentence claiming absence cannot cite a verified record.

Citation anchorsEvery regulatory reference must exist in the clause corpus and resolve to its text. No bare anchors, no free-text clauses.
Quote fidelityQuoted evidence must match the record, character for character.
Phrasing modesContradiction, absence, unverifiable, plain — the sentence’s mode must be licensed by the evidence row it cites.
Extent arithmetic“Four (4) of the twelve (12)” is recomputed against the register, not trusted.
Blinding scannerAny text leaving the system — prompts included — is scanned before it goes.
The recordPrompt, model, tools, result, verdicts, and the human’s decision land in one append-only record. The GxP audit trail is not optional logging.

Rejected

“No documentation was available to demonstrate IMP storage temperature monitoring.”

Absence sentence citing E-114 · temperature log · Verified — the mode is not licensed by its row.

Accepted

“However, the temperature log for March 2026 shows two (2) excursions without a documented assessment.”

Contradiction — licensed by E-114.

Data sovereignty

Nothing leaves
your infrastructure.

Audit evidence contains clinical trial data — a deliberate compliance property, not a preference. Soterias runs its own model plane: open-weights models on your hardware, remote routes hard-excluded from skill routing.

Open weights, your metal. Conversational, structured, embedding, and vision models served inside your boundary.
Append-only memory. Findings supersede; they are not silently edited. Audit records must show what was known when.
Blinded by default. Site-facing artifacts carry no sponsor identity; every outbound text passes the blinding scanner.
A route hosted APIs cannot offer. Accepted outputs accumulate into per-skill adapters — the assistant learns your house style without your data leaving home.

943: clause-anchored provisions
9 · 64 · 9: stages, steps, human gates
8-part: finding model, extent quantified
8/8: top-1 Turkish→English clause retrieval

The core rules

The discipline, encoded.

Twelve rules travel with every blueprint. The assistant is bound by them; the auditor is served by them.

I
Evidence precedes conclusion. An explanation is not accepted where a contemporaneous record should exist.
II
The requirement of the event date applies. Findings cite the version in force when it happened.
III
Critical processes receive greater coverage. Depth follows risk, not convenience.
IV
Sampling remains dynamic. A planned sample is a starting point, not a limitation.
V
Evidence is triangulated. Records, systems, and interviews are read against each other.
VI
Extent is quantified. “Several” is not a number.
VII
Facts, causes, and risks are separated. Each layer earns its own sentence.
VIII
Independence is preserved. Comments may correct facts; they do not negotiate the auditor’s conclusion.
IX
Preliminary observations are not findings. The exit meeting hears observations; the report states findings.
X
Ownership is explicit. Every finding names the party that must answer it.
XI
Correction does not erase the condition. A post-audit fix does not rewrite what was found.
XII
Closure requires evidence. Not only promises.

Who it serves

Built for the people
who carry the signature.

Sponsor QA

Run your audit programme on one spine — routine, for-cause, directed — with your severity definitions printed verbatim and your SLAs timed to the day-type.

QA consultancies

Audit on a sponsor’s behalf with tenant-clean separation: their templates, their numbering, their outcome scale — your method.

CRO quality

Own your share of the findings register cleanly: per-addressee response views, citations stripped where they must be, ownership explicit.

Bilingual by design — Turkish working language, English controlled output. Cross-lingual clause retrieval measured at eight of eight, top-1.

The name

Named for the guardian.

ΣΩΤΗΡΙΑ — Soteria — is the Greek personification of safety, preservation, and deliverance from harm. Her name in the genitive, soterias, means of safekeeping.

Clinical research exists to protect the people inside it. Audits exist to prove that protection held. Soterias is the instrument for that proof: an assistant bound to evidence, a workflow bound to gates, and an auditor in command of both.

We hold ourselves to the auditor’s standard. An empty report passes gates as easily as a good one — so we measure the assistant against real, completed engagements, replay them honestly, and ship no capability we have not measured.

Soterias is in development with practising GCP auditors. We are selecting a small number of design partners for 2026 pilots.

Bring the guardian into
your audit programme.

Design-partner pilots for sponsor QA, QA consultancies, and CRO quality — starting 2026.

Request a pilot nazen.atalay@soterias.ai