Validfor

No integration, connector or API is named anywhere on the site; the AI works on validation records held inside the platform. The full navigation, across product, trust and policy pages among others, carries no integrations page or connector list, and no API or named system, and the home page, Contextual AI page and LLM Usage Policy describe AI working on Validfor's own records. The product validates a customer's computerized systems, which is its subject, not a connection that lets an agent act in those systems.

Sourcevalidfor.com home and navigation, /contextual-ai/; readread 2026-09-16

The validation lifecycle runs through integrated modules with AI generation steps, but the AI is described as a supporting capability, not an autonomous one. Change, Deviation and Test modules, along with Periodic Review, run the lifecycle with tailored rules and intelligent linking, and AI generates validation protocols, reports and documentation inside it.

The Contextual AI page states "AI is used as a supporting capability... not as an autonomous decision-making system," and says the AI does not validate, approve or reject on its own. Branching, retries and reuse are not documented. The home page's "network of AI agents" and the policy page's "supporting capability" describe the same product differently, and the policy page is the more specific of the two.

Sourcevalidfor.com home, /contextual-ai/; readread 2026-09-16

The AI is grounded in the customer's own validation records, but no retrieval layer over customer documents is documented. The Contextual AI page says the AI "suggests relationships between requirements, tests, and deviations based on historical records," highlights potential gaps and supports knowledge capture, and the home page says System Understanding "analyzes system requirements."

The linkage between requirements, tests and deviations is the validation record's own traceability model. No maintained index, graph or embeddings layer is documented, and no source ingestion or citations either. Alignment with GxP rules, including Part 11, Annex 11 and GAMP 5, describes the product's regulatory fit, not a knowledge source the buyer maintains.

Sourcevalidfor.com/contextual-ai/, home; readread 2026-09-16

An authorized user must approve every AI recommendation before anything changes.

The Contextual AI page (updated 18 November 2025) states "AI-generated recommendations are advisory only and must be reviewed and approved by authorized users before implementation," "no automated action or system change is executed without explicit human confirmation," and "human-in-the-loop: every recommendation requires human confirmation."

The AI does not validate, approve or reject on its own, and it does not alter or delete validation records. The LLM Usage Policy adds expert human review of all content the AI generates before official use. Every AI action has a mandatory checkpoint, open only to authorized users, before it runs.

The gate cannot be configured, so there are no autonomy modes by risk, and routing approvals to other channels is not described.

Sourcevalidfor.com/contextual-ai/, /llm-usage-policy/; readread 2026-09-16

Role based access and isolated instances are documented, but every compliance claim is an assertion rather than an attestation.

The Sprinto trust center at validfor.trust.site lists ISO 27001, ISO 27701, ISO 27017, ISO 27018, ISO 9001 and ISO 22301, along with GDPR and HIPAA, each as "Compliant," and ISO 27005 as "In progress," with no certificate, auditor, report or date for any of them; the home page repeats the list the same way.

A separate AI Trust Center page on validfor.com attributes the platform to a different company and, in the same section, says no third party services provide AI functionality, with badges that also read Compliant with no certificate, auditor, report or date, so its claims cannot be relied on.

For access, the LLM Usage Policy applies "role-based access control and session logging," the Responsible Use of AI page says AI processing runs "under documented access management" in an isolated instance per customer, and the trust center lists Team Management and Access Monitoring among its product and data security controls. No SSO, SAML or SCIM is documented.

Sourcevalidfor.trust.site; validfor.com/llm-usage-policy/, /responsible-use-of-ai/, home; readread 2026-09-16

Each AI action is logged with timestamp, user and reference data, and the reasoning behind each recommendation can be reviewed.

The Contextual AI page (updated 18 November 2025) states "traceability: each AI action is logged with timestamp, user, and reference data" and "transparency: the logic behind each recommendation can be reviewed and documented," and says AI models are subject to audit trail logging and documented change control. The LLM Usage Policy names session logging for LLM activity.

Logs per action with reasoning that can be reviewed, alongside the separate Part 11 audit trail, let a buyer see each run after the fact. Traceability of the customer's own validated systems is a different thing.

Export to a SIEM and retention are not documented, and the logging is stated on a policy page rather than shown in product documentation.

Sourcevalidfor.com/contextual-ai/, /llm-usage-policy/; readread 2026-09-16

No AI memory separate from the validation records is documented. Validation records, electronic records and the linkage between requirements, tests and deviations are the validated business record itself, so deleting them would delete the record, not a memory layer. No session, conversation or workflow memory with a stated scope and lifetime appears on the home, Contextual AI or LLM Usage Policy pages, and no long term memory either. When the AI makes suggestions "based on historical records," it reads the application's own records.

Sourcevalidfor.com home, /contextual-ai/, /llm-usage-policy/; readread 2026-09-16

Each customer runs in an isolated instance that Validfor hosts, with no region or deployment choice. The Responsible Use of AI page says "every customer operates in an isolated, validated instance of the Validfor platform" and "all AI processing occurs within Validfor's controlled infrastructure."

So the LLM Usage Policy's "private enterprise instances or on-premise models" and "isolated within the client's own environment" describe an isolated tenant on Validfor's own infrastructure, not a deployment option for the customer. No hosting region, residency statement or deployment choice appears on the home, policy or trust pages. Isolation per tenant is a security property, not a residency option.

Sourcevalidfor.com/responsible-use-of-ai/, /llm-usage-policy/; readread 2026-09-16

Validation workflows ready to use ship as modules of one platform, not as agents a buyer adopts separately. The product menu lists four modules of one Digital Validation Platform, from Change and Deviation Management to Test and Periodic Review Management, and the home page names three AI capabilities, System Understanding, Automated Validation Artifacts and Continuous Compliance Monitoring, within a single network of agents. A /templates/ page appears in the site links. The modules are prebuilt validation workflows.

They are stages of one validation lifecycle rather than products doing separate jobs, and the three AI capabilities are parts of one network, not agents a buyer selects. Modules a customer wires together are a pricing structure.

Sourcevalidfor.com home and product menu; readread 2026-09-16

Detected system changes and scheduled reviews start AI work without anyone asking.

Under "Powered by Agentic AI," the home page says Validfor "uses a network of AI agents" and that System Understanding "analyzes system requirements and detects changes automatically to keep validation aligned with evolving systems," while Continuous Compliance Monitoring "detects compliance gaps before they become audit risks."

The product menu lists Periodic Review Management as "automated reviews for compliance and integrity." A detected change and a scheduled periodic review both start AI work, and what the AI then does is advisory and confirmed by a person.

How a change is defined and how schedules are configured are not documented on public pages, and the mechanism is stated in marketing copy rather than product documentation.

Sourcevalidfor.com home and product menu; readread 2026-09-16

No model or provider is named, and there is no model choice. The LLM Usage Policy says Validfor's "AI models are pre-trained on publicly available or ethically licensed datasets only," that customer data never retrains or fine tunes them, and that inputs and outputs are never shared with external AI providers.

The Responsible Use of AI page says "all AI processing occurs within Validfor's controlled infrastructure" and that no customer data goes to external AI services, and the Contextual AI page and EU AI Act Compliance Statement describe AI as decision support under human approval. None names a model or provider, discloses routing across models, or gives the customer or an admin a choice. "Private enterprise instances or on-premise models" is a statement about hosting.

Sourcevalidfor.com/llm-usage-policy/, /responsible-use-of-ai/, /contextual-ai/, /eu-ai-act-compliance-statement/; readread 2026-09-16

The product, as published, is used only through its interface, and no developer surface appears. The full navigation, across product, trust and policy pages among others, carries no developer page, API reference or SDK, and no webhook or MCP surface, and the home page, Contextual AI page and LLM Usage Policy describe Validfor's AI only inside its own validation platform.

Sourcevalidfor.com home and navigation; readread 2026-09-16

Customers have no documented way to test or score the AI's recommendations, and what looks like evaluation measures something else. The Test Management module tests the customer's computerized systems, which is the product's subject, not the AI. The Contextual AI page says "AI functions are validated as part of the overall software lifecycle" and that AI models go through internal validation, which is Validfor checking its own models, not a surface the customer runs. No test run by the customer with fixtures or datasets, no simulation and no scored evaluation of the AI's output is documented.

Sourcevalidfor.com/contextual-ai/, home; readread 2026-09-16

The AI works only on validation data inside the platform, so there is no browser or computer control. The Contextual AI page limits the AI to organizing validation data, suggesting relationships between requirements, tests and deviations, and highlighting gaps while keeping records consistent, and says it does not alter or delete validation records. No page describes an agent operating a browser, desktop or another application's screens, so changes to a user interface have nothing to break.

Sourcevalidfor.com/contextual-ai/, home; readread 2026-09-16